Nodejs, Socket.io, Redis, Laravel - security?

Question

I'm using Laravel 5.1 for my backend and at the same time, I have Nodejs server running purely for socket.io and this is only for the 'news' table.

Basically, every single time an item is added to the news table in mySQL, Laravel broadcasts an event, which is caught by socket.io on the client and then socket.io sends off an AJAX call to the server API to retrieve the news item.

I am very new to Node.js and this is my first project actually using it. I was thinking about using pusher instead, for Real-time updates, but wanted to try something new and went for this setup.

So my question is, how secure is Node.js server in this scenario? It runs a very simple server at the moment as I said, which is solely for socket.io and nothing else. Are there any security measures I should take before the app goes LIVE?

Eric · Accepted Answer · 2015-07-17 15:03:56Z

1

If you only use socket.io and your backend script in node only dispatches to the socket (and doesn't receive any data from the front end), you shouldn't have anything to worry about. You could also only dispatch to clients that have a PHP session, and for that you can use Redis between PHP & Node.

answered Jul 17, 2015 at 15:03

Eric

10.7k14 gold badges75 silver badges112 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

mtpultz Over a year ago

Do you know of a good tutorial or example of how to determine that a PHP session exists using Redis and NodeJS? I've built a two-way chat and I don't know what I need to do to secure it. Built it with Laravel 5 + Redis + NodeJS.

Eric Over a year ago

Sorry I don't. But you could do something like (from the top of my head): generate a random string and save it and the ip in the session and redis. When your node client connects to the node server, expect the random string to be passed. Check if the combo random string + ip is in redis from node, then allow the socket to send/receive.

Collectives™ on Stack Overflow

Nodejs, Socket.io, Redis, Laravel - security?

1 Answer 1

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related