如何设置 socket.io origins 以限制连接到一个 url

Question

We have one html site and one node.js server which serves that website. The website and the server exchange data using socke.io. We found this in the documentation:

origins defaults to *:* The origins that are allowed to connect to the Socket.IO server.

Our html.site is on http://questionexample.com/page1 . Only this site may connect to our server.(But everyone may connect to that website.) How do we have to set the origins?

Answer 1

If you dig into Socket.io source code, you will find such lines:

var origin = request.headers.origin || request.headers.referer
  , origins = this.get('origins');

...

var parts = url.parse(origin);
parts.port = parts.port || 80;
var ok =
  ~origins.indexOf(parts.hostname + ':' + parts.port) ||
  ~origins.indexOf(parts.hostname + ':*') ||
  ~origins.indexOf('*:' + parts.port);

As you can see Socket.io takes origin (or referer) that came from the client, retrieves domain name and port, and compares with the origins option you specified.

So the valid origins values are ( * means "any"):

• testsite.com:80
• http://testsite.com:80
• http://*:8080
• *:8080
• testsite.com:* http://someotherdomain.com:8080 (multiple origins separated by space)
• testsite.com:*/somepath (socket.io will ignore /somepath)
• *:*

And these are invalid (because no port number):

• testsite.com
• http://testsite.com
• http://testsite.com/somepath

Also note that if you specify sub.testsite.com as origins value, the testsite.com will be valid origin.

Answer 2

I've had similar problem. Try run node in production mode NODE_ENV=production node app.js . I had that code ( as recommended here ):

io.configure('production', function(){
    console.log("Server in production mode");
    io.enable('browser client minification');  // send minified client
    io.enable('browser client etag'); // apply etag caching logic based on version number
    io.enable('browser client gzip'); // the file
    io.set('log level', 1);           // logging
    io.set('transports', [            // all transports (optional if you want flashsocket)
        'websocket'
        , 'flashsocket'
        , 'htmlfile'
        , 'xhr-polling'
        , 'jsonp-polling'
    ]);
io.set('origins', 'http://questionexample.com/page1:*');
});

and Node rans in development mode so it simply couldn't work. After enabling production mode everything is ok.

I know that it is a little bit late answer but maybe someone else will use that

Answer 3

For newer versions of socket.io (up to the current 4.xx you need to set CORS origin as part of the server options.

CORS is now split off into its own module - See the readme for details.

The default config is;

{
  "origin": "*",
  "methods": "GET,HEAD,PUT,PATCH,POST,DELETE",
  "preflightContinue": false,
  "optionsSuccessStatus": 204
}

and to restrict to one site with any subdomain use;

cors: {
        origin: [/\.example\.com$/],
        methods: ["GET", "POST"]
        }

Here is a very simple/basic config block for those who come looking without using express or anything other than the raw socket.io engine; Edit: Updated for version 3 of socket.io .

// Options for socket.io => 3.0.0
var options = {
        allowUpgrades: true,
        transports: [ 'polling', 'websocket' ],
        pingTimeout: 9000,
        pingInterval: 3000,
        cookie: 'mycookie',
        httpCompression: true,
        cors: '*:*' <---- Allow any origin here [NOTE THE NAME CHANGE]
};

Older versions use;

// Options for socket.io > 1.0.0
var options = {
        allowUpgrades: true,
        transports: [ 'polling', 'websocket' ],
        pingTimeout: 9000,
        pingInterval: 3000,
        cookie: 'mycookie',
        httpCompression: true,
        origins: '*:*' <---- Allow any origin here
};

io = require('socket.io')(8010, options);

Answer 4

You can do something like this on server side with url of your site

  if (origin !== 'https://foo.example.com') {
    return callback('origin not allowed', false);
  }
  callback(null, true);
});

Answer 5

我认为io.set('origins', http://questionexample.com/page1)应该这样做