How can I securely implement a notification system using socket?

Question

I am currently working on a web application using the MEAN stack. It has a social aspect to it so I want to be able to push notifications to users.

The way I do it now is when something happens that should be a notification it gets stored in a mongo database with an unread flag. Each client will send a get request to the server every 30 second and will receive every notification marked as unread, and will then mark it as read.

I want to switch to using a message queue and sockets so less network resources will be used, and also provide the user with a real-time experience. I've thought about using redis and its pubsub structure but I can't seem to figure out how to do this securely. If I push out notifications to the affected users, won't it be easy for someone malicious to subscribe to somebody else's channel and receive notifications not meant for them? Am I missing something or is it just the wrong approach for such a system?

Edit: Figure I update with the solution I went with if anyone else reading this is having the same problem.

Instead of using rabbitmq, as the answer suggested, I figured that a much more easy and elegant solution is to just use socket.io. When new sockets connects to the server I save a mapping from the userID to the socketId in a redis in-memory DB. (After I've validated their token) That way, if I need to push a notification to a user I just look up the socketId in the redis DB, and then send it to the correct socket. This way I don't need any security beyond that as socketIDs are unguessable, and the message is only sent across the single socket that belongs to the given user.

This way it will only get sent through the connection of the given socket, as socketIDs are only used server side to keep track of all the connection. This means no one else can "listen" using someone else's socketID.

Answer 1

you can use RabbitMQ for this. Also authentication is there. Please go through following link and try.

https://www.rabbitmq.com/access-control.html

also, you can apply authentication in existing structure using subscription auth tokens with all subscribed users only. even redis has its security with topics. Please have a look in link below

https://redis.io/topics/security