Preventing socket.join("room") client-side, listening for private room leaving

Question

i'm developing an application with Socket.IO that needs to authenticate if user can join a room.

Client side:

var socket = io('http://<?php echo $_SERVER['HTTP_HOST'];?>:3000');
socket.on('connect', function() {
    var req = [current_user_id,secret_hash];
    socket.emit('join', req);
});

Server listens on join requests of clients, gets access to a MySQL database and evaluates if user can join or not the requested hash channel:

        ...
        if (rows.length == 1) {
            socket.join(request[1]); //join on channel ID which is request[1] cell of array
        }
        //if not authorized, does not allow joining.
        ...

I've got two questions:

1) I don't want to allow client side direct joning of channel. Clients must not be able to launch socket.join("room"). How can i block those requests? Server is the only one that cares about assigning rooms.

2) Is there a way to listen for event "user leaves his private channel id"?

Thanks.

Answer 1

The client-side socket.io library does not have the ability to .join() a room. That ability is only in the server-side library (because that's where the rooms are maintained) and thus the only place it can actually be processed.

So, the only way to join a room is to make your own message for a join request from client to server and process that message on the server on behalf of a given client which enables you to do any sort of checking you want before any client can join a particular room. As such, you should be safe the way you're already doing it.

---

Similarly, there are only two ways that a client leaves a room. The first is when you process your own message and call .leave() server-side so you can certainly monitor any time that happens since it's your own server-side code calling .leave(). The other way a client leaves a room is when the client disconnects and you can also monitor for disconnects in the server. Like with .join(), the client cannot call .leave() directly so you don't have to worry about that.