i'm developing an application with Socket.IO that needs to authenticate if user can join a room.

Client side:

var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000');
socket.on('connect', function() {
    var req = [current_user_id,secret_hash];
    socket.emit('join', req);

Server listens on join requests of clients, gets access to a MySQL database and evaluates if user can join or not the requested hash channel:

        if (rows.length == 1) {
            socket.join(request[1]); //join on channel ID which is request[1] cell of array
        //if not authorized, does not allow joining.

I've got two questions:

1) I don't want to allow client side direct joning of channel. Clients must not be able to launch socket.join("room"). How can i block those requests? Server is the only one that cares about assigning rooms.

2) Is there a way to listen for event "user leaves his private channel id"?


1 Answer 1


The client-side socket.io library does not have the ability to .join() a room. That ability is only in the server-side library (because that's where the rooms are maintained) and thus the only place it can actually be processed.

So, the only way to join a room is to make your own message for a join request from client to server and process that message on the server on behalf of a given client which enables you to do any sort of checking you want before any client can join a particular room. As such, you should be safe the way you're already doing it.

Similarly, there are only two ways that a client leaves a room. The first is when you process your own message and call .leave() server-side so you can certainly monitor any time that happens since it's your own server-side code calling .leave(). The other way a client leaves a room is when the client disconnects and you can also monitor for disconnects in the server. Like with .join(), the client cannot call .leave() directly so you don't have to worry about that.

  • Nice, i did not notice that .join() was only server side. However, i need to perform actions when user leaves his private channel. Listening on io.on(disconnect) would not be enough, i need some event on leaving of any room. Commented Jan 3, 2015 at 9:15
  • @Mario90 - client-side event or server-side event upon leaving a room?
    – jfriend00
    Commented Jan 3, 2015 at 16:06
  • Server side event, binded on any room leaved, in my case user's private room. Commented Jan 3, 2015 at 16:14
  • @Mario90 - as described in my answer, you can listen for disconnect events and just change any place in your server-side code that does a .leave() to notify your server code that one is leaving a room when it does the .leave(). Since all the server-side code is under your control, this should be something you can do. If you really want to automate this, then you could override the .leave() method so that it would do the .leave() and then notify you. Or, you could create your own .leaveNotify() method and replace all occurrences of .leave() in your own code with .leaveNotify().
    – jfriend00
    Commented Jan 3, 2015 at 16:20
  • Could you please do a code example? Thanks. Commented Jan 3, 2015 at 21:28

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .