How to guard private channels when using socket.io and Laravel Echo? - laravel

Here is my server.js file:
var app = require('express')();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var Redis = require('ioredis');
var redis = new Redis();
http.listen(3000, function(){
console.log('Listening on Port 3000');
});
redis.psubscribe('*', function(err, count) {
console.log(err, count);
});
redis.on('pmessage', function(subscribed, channel, message) {
message = JSON.parse(message);
io.emit(message.event, channel, message.data);
});
And a simple event:
class FieldWasUpdated implements ShouldBroadcast
{
use InteractsWithSockets, SerializesModels;
public $instance;
public $key;
public $value;
public function __construct($instance, $key, $value)
{
$this->instance = $instance;
$this->key = $key;
$this->value = $value;
}
public function broadcastOn()
{
return new PrivateChannel("model." . $this->instance->getModelType() . "." . $this->instance->id);
}
}
The client connects to socket.io:
Echo = new Echo({
broadcaster: 'socket.io',
host: window.location.hostname + ':3000'
});
And then listens for events (it is inside a Blade template):
var channel = "model.{{ $instance->getModelType() }}.{{ $instance->id }}";
Echo.private(channel)
.listen("FieldWasUpdated", function(e) {
window.VueBus.$emit("updated", channel, e.key, e.value);
})
.listen("FieldBecameDisabled", function(e) {
window.VueBus.$emit("disabled", channel, e.key);
});
Problem is: authentication is not handled, any user can subscribe to these channels.
Broadcast::channel("model.announcement.*", function($user, $id) {
return false; // this function is not called
})
Here is a sample event from the Chrome developer console (WebSocket):
[
"App\\Events\\FieldWasUpdated",
"private-model.announcement.2",
{
"instance":
{
"type":"ANN_TYPE_MISSED_CALL",
"status":"ANN_STATUS_CANCELLED",
"name":"1233421",
"phone":"+7(222)222-3322",
"email":"sdgsg#mail.com",
"message":"sdgdsgsdgdfdg",
"requirement":null,
"web_type":"ANN_WEB_TYPE_UNKNOWN",
"url":null,
"responsible_id":19,
"recommender_id":18
},
"key":"message",
"value":"sdgdsgsdgdfdg"
}
]
Also there is no /broadcast/auth URL, but BroadcastServiceProvider has a call to Broadcast::routes(); and when the browser loads, no calls to /broadcast/auth occur.

The Laravel documentation goes into detail about this in the Broadcasting chapter: https://laravel.com/docs/5.5/broadcasting#presence-channels. The Authorizing Presence Channels section should be the same for private channels.

Related

Laravel with Socket/Redis - Private channel routes not working

I am kinda stuck in broadcast routes. i setup a socket server with redis and configured it with Laravel. For public channel ,everything is working fine but when it comes to private or presence channel, it is somehow bypassing laravel broadcast routes. Can't figured out how & why.
i have attached a repo link so you guys can explore it too. Plus some quick bits are also below.
https://github.com/bilahdsid/socket-laravel/tree/socket
TestEvent.php
class TestEvent implements ShouldBroadcast
{
use Dispatchable, InteractsWithSockets;
/**
* Create a new event instance.
*
* #return void
*/
public $data;
public function __construct()
{
$this->data = array(
'power'=> '10'
);
}
public function broadcastOn()
{
return new PrivateChannel('test-channel1');
}
public function broadcastWith()
{
return $this->data;
}
}
server.js
var app = require('express')();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var Redis = require('ioredis');
var redis = new Redis();
redis.subscribe('private-test-channel1', function(err, count) {
console.log(err);
});
redis.on('connection',function (socket,channel) {
console.log(socket+''|+channel);
});
redis.on('message', function(channel, message) {
console.log('Message Recieved: ' + message);
message = JSON.parse(message);
io.emit(channel + ':' + message.event, message.data);
});
http.listen(3000, function(){
console.log('Listening on Port 3000');
});
io.on('connection', function(socket){
console.log('a user connected');
});
routes/web-- for firing
Route::get('/', function () {
return view('home');
});
Route::get('fire', function () {
// this fires the event
broadcast(new App\Events\TestEvent());
return "event fired";
});
routes/channel.php -- below line doesn't work-- main issue
Broadcast::channel('private-test-channel', function ($user, $id) {
echo '1111'; exit;
return (int) $user->id === (int) $id;
});
Thanks.
As far as I can see you are defining a channel with the name: test-channel1:
public function broadcastOn()
{
return new PrivateChannel('test-channel1');
}
but in routes/channels.php:
Broadcast::channel('private-test-channel', function ($user, $id) {
Sounds like a typo!

Change channel dynamic with laravel,Socket and Redis

!!!
Server - socket How can change channal dynamic
When I broadcast using /fire/1 for example, I only want to send to /room/1.
Currently it sends to /room/1, /room/2, /room/3, etc. Because by default here, everything on the server is subscribed to 'test-channel'. I just can't figure this out.
var server = require('http').Server();
var io = require('socket.io')(server);
var Redis = require('ioredis');
var redis = new Redis();
io.on('connection', function(socket){
console.log('New User Conected here');
redis.subscribe('test-channel');
redis.on('message', function(subscribed ,channel, message) {
console.log(channel);
message = JSON.parse(message);
socket.emit(channel + ':' + message.event, message.data);
});
socket.on('joinRoom', function(room ){
console.log('Join in this Room '+ room);
socket.join(room);
});
});
server.listen(3000);
event | php
public function broadcastOn()
{
return ['test-channel']; // static
}
Add a property to your broadcast event, then pass it to the constructor.
class Message implements ShouldBroadcast{
use SerializesModels;
protected $channel;
public function __construct($channel){
$this->channel = $channel;
}
public function broadcastOn(){
return [$this->channel];
}
}
Then when you fire the event, pass the channel in: event(new Message($channel));

Spring websocket Server and unity3d client

i'm using the spring web socket , it's a chat web socket app, every user msg will be delivered to all users, this below my home.html
function connect() {
var socket = new SockJS('http://192.168.1.115:8080/ROOT/hello');
stompClient = Stomp.over(socket);
stompClient.connect({}, function(frame) {
setConnected(true);
console.log('Connected: ' + frame);
stompClient.subscribe('/topic/greetings', function(greeting) {
console.log(greeting);
console.log("greetinggggggggg");
showGreeting(JSON.parse(greeting.body).content);
});
});
}
function disconnect() {
if (stompClient != null) {
stompClient.disconnect();
}
setConnected(false);
console.log("Disconnected");
}
function sendName() {
var name = document.getElementById('name').value;
stompClient.send("/app/hello", {}, JSON.stringify({
'name' : name
}));
}
I want to use a unity3d app as client, actually i'm using socket io to connect to a web socket endpoint.
socket io link on assets store https://www.assetstore.unity3d.com/en/#!/content/21721
i could connect to the endpoint but i could not find how to subscribe to /topic/greetings as
stompClient.subscribe('/topic/greetings', function(greeting){
console.log(greeting);
console.log("greetinggggggggg");
showGreeting(JSON.parse(greeting.body).content);
});
});
Thanks

Laravel echo does not receive broadcast message

Here is event
<?php
namespace App\Events;
use Illuminate\Broadcasting\Channel;
use Illuminate\Queue\SerializesModels;
use Illuminate\Broadcasting\PrivateChannel;
use Illuminate\Broadcasting\PresenceChannel;
use Illuminate\Broadcasting\InteractsWithSockets;
use Illuminate\Contracts\Broadcasting\ShouldBroadcast;
class FieldWasUpdated implements ShouldBroadcast
{
use InteractsWithSockets, SerializesModels;
public $instance;
public $key;
public $value;
/**
* Create a new event instance.
*
* #return void
*/
public function __construct($instance, $key, $value)
{
$this->instance = $instance;
$this->key = $key;
$this->value = $value;
}
/**
* Get the channels the event should broadcast on.
*
* #return Channel|array
*/
public function broadcastOn()
{
return new Channel("model." . $this->instance->getModelType() . "." . $this->instance->id);
}
//public function broadcastAs() {
// return "FieldWasUpdated"; commented out for testing
//}
}
Here is frontend code
window.Echo = new window.LaravelEcho({
broadcaster: 'socket.io',
host: window.location.hostname + ':3000'
});
// I use different types of `listen` for testing
Echo.channel("model.ANNOUNCEMENT.2")
.listen(".*", function(e) {
console.log(e);
})
.listen("*", function(e) {
console.log(e);
})
.listen("FieldWasUpdated", function(e) {
console.log(e);
})
.listen(".FieldWasUpdated", function(e) {
console.log(e);
})
node.js code
var app = require('express')();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var Redis = require('ioredis');
var redis = new Redis();
http.listen(3000, function(){
console.log('Listening on Port 3000');
});
redis.psubscribe('*', function(err, count) {
console.log(err, count);
});
redis.on('pmessage', function(subscribed, channel, message) {
// different types of emit for testing
message = JSON.parse(message);
const ev = channel + ":" + message.event;
io.emit(ev, message.data);
io.emit(channel, message);
io.emit(message, channel);
io.emit(channel, message.event, message.data);
io.emit(channel, message);
io.emit(channel, message.data, message.event);
});
Here is what I see in chrome development tools when Event is fired inside laravel app
So websocket is working but no one handler is called.
When I uncomment broadcastAs function nothing is changed.
When I rename channel to test-channel in backend and frontend - nothing changes.
After some time found a solution:
Server:
redis.psubscribe('*', function(err, count) {
console.log(err, count);
});
redis.on('pmessage', function(subscribed, channel, message) {
message = JSON.parse(message);
io.emit(message.event, channel, message.data);
});
Client
// both handlers process same event
Echo.channel("model.ANNOUNCEMENT.2")
.listen("FieldWasUpdated", function(e) {
console.log(e);
})
.listen(".App.Events.FieldWasUpdated", function(e) {
console.log(e);
})

Laravel IO Socket and redis over SSL https connection

Currently have IO sockets with laravel broadcasting with redis working perfectly. Until I then set up an SSL cert on the domain.
I have redis-server running on port 3001.
Then there is a socket.js set to listen to 3000.
My JS on the page I listen via io('//{{ $listen }}:3000').
Any guidance would be great on how to get this working over https. Would I just use 443 as the port?
Thanks.
My socket.js
var app = require('express')();
var http = require('http').Server(app);
var io = require('socket.io')(http);
var Redis = require('ioredis');
var redis = new Redis();
redis.subscribe('notifications', function(err, count) {
});
redis.on('message', function(channel, message) {
console.log('Message Recieved: ' + message);
message = JSON.parse(message);
io.emit(channel + ':' + message.event, message.data);
});
http.listen(3000, function(){
console.log('Listening on Port 3000');
});
First, setup your serverOptions object:
var serverOptions = {
port: 3000,
host: 127.0.0.1, //address to your site
key: '/etc/nginx/ssl/your_site/server.key', //Or whatever the path to your SSL is
cert: '/etc/nginx/ssl/your_site/server.crt',
NPNProtocols: ['http/2.0', 'spdy', 'http/1.1', 'http/1.0']
}
For the NPNProtocols, you may not care for all of them, but they're provided for reference.
Now just create the server:
var app = require('https').createServer(serverOptions),
io = require('socket.io')(app);
This should be pretty plug and play into your source at his point.\
As a side note your stuff is completely wide open and anyone can listen on your web socket, so nothing should be sent that is private through here. If you need to make your data private, then you're going to need 1 of two things;
Something like JWT-Auth Token
Something custom that interface with the Redis queue:
Here's an example of the latter:
var SECRET_KEY = '<YOUR_LARAVEL_SECRET_KEY>';
var laravel_session_parser = {
ord: function (string) {
return string.charCodeAt(0);
},
decryptSession: function (cookie, secret) {
if (cookie) {
var session_cookie = JSON.parse(new Buffer(cookie, 'base64'));
var iv = new Buffer(session_cookie.iv, 'base64');
var value = new Buffer(session_cookie.value, 'base64');
var rijCbc = new mcrypt.MCrypt('rijndael-128', 'cbc');
rijCbc.open(secret, iv);
var decrypted = rijCbc.decrypt(value).toString();
var len = decrypted.length - 1;
var pad = laravel_session_parser.ord(decrypted.charAt(len));
return phpunserialize.unserialize(decrypted.substr(0, decrypted.length - pad));
}
return null;
},
getUidFromObj: function (obj, pattern) {
var regexp = /login_web_([a-zA-Z0-9]+)/gi;
if (pattern) {
regexp = pattern;
}
var u_id = null;
for (var key in obj) {
var matches_array = key.match(regexp);
if (matches_array && matches_array.length > 0) {
u_id = obj[matches_array[0]];
return u_id;
}
}
return u_id;
},
getRedisSession: function (s_id, cb) {
var _sessionId = 'laravel:' + s_id;
client.get(_sessionId, function (err, session) {
if (err) {
cb && cb(err);
return;
}
cb && cb(null, session);
});
},
getSessionId: function (session, _callback) {
var u_id = null,
err = null;
try {
var laravelSession = phpunserialize.unserialize(phpunserialize.unserialize(session));
u_id = laravel_session_parser.getUidFromObj(laravelSession);
} catch (err) {
_callback(err, null);
}
_callback(err, u_id);
},
ready: function (socket, _callback) {
if (typeof socket.handshake.headers.cookie === 'string') {
var cookies = cookie.parse(socket.handshake.headers.cookie);
var laravel_session = cookies.laravel_session;
var session_id = laravel_session_parser.decryptSession(laravel_session, SECRET_KEY);
laravel_session_parser.getRedisSession(session_id, function (err, session) {
if (!err && session) {
laravel_session_parser.getSessionId(session, function (err, user_id) {
if (user_id) {
_callback(null, session_id, user_id, laravel_session)
} else {
_callback(new Error('Authentication error'), null);
}
});
} else {
_callback(new Error('Authentication error'), null);
}
});
}
}
};
Now you can just have IO get an instance of the individuals session when they establish a connection to socket.io
io.on('connection', function (socket) {
laravel_session_parser.ready(socket, function(err, session_id, user_id, laravel_session) {
//log out the variables above to see what they provide
});
});
Note, I prefer to use dotenv in NodeJS to share environment variables between Laravel and Node.
Then you can do process.env.APP_KEY and you don't need to worry about sharing variables.
Also of note, that script above is not complete and is not production ready, it's just meant to be used as an example.

Resources