Socket.io-标头-查询字符串-安全

Question

I want to cover several aspects here. Let's unfold.

I'm using Socket.io in one of my application. While trying keeping JWT common for normal application and socket.io client, I had these thoughts.

1. Socket.io uses HTTP(S) protocol with GET method as I found out so far. Or does it support POST too? If so, how? If not, why?
2. While number of posts claims to use query parameters to pass JWT which won't be "that bad" on HTTPS, I have resilience to do so given that a handsome amount of browser extensions typically read URLs. So I'm more towards using Headers. Which, btw, is their designated job too. Or am I being mislead by little information?
3. Headers brings us to next question, how headers and query strings being transported over the wire? Is one safer than the other? Are headers less visible to the world while on the way?
4. Oh! And how do I set headers in Socket.io client ?

Helps would be appreciated, Thanks!

PS Please make correction(s) to the post title if necessary.

Answer 1

1) socket.io uses websockets as the name suggests, so it should actually use the wss protocol, using polling & https is just a fallback afaik.

2) browser extension might also read the header? I don't see any advantage from one over the other.

3) as 1s and 0s ? Both are encrypted however (because of http s and ws s ).

4) Why do you want that? If you want to use socket.io, just .emit() events, that's what socket.io is all about. If you don't want websockets but some self-baked solution, create your own one.