node.js - A Case of Socket IO authentication using Passport with Node-Express and MongoDB -

this setup -

three different servers running 3 different node js application on 3 different ec2 servers.

server 1 - running main application.

server 2 - running admin application.

server 3 - running service provider application.

each server using same mongodb database because have share collections.

so have -

server 4 - database server - running mongo db.

in database there 3 collections representing 3 types of users -

1] main user 2] admin user 3] service provider

each type of user logs own nodejs application connecting respective server using different client applications.

for example admin user connects server 2 , logs in admin application.

for login passport used, , sessions stored in mongo db, using connect-mongo . sessions of types of user stored in same sessions collection in mongo db.

the problem -

now want implement notification system using socket.io. each type of user has notification sub-document array in model. -

main user schema

              {                  ....                   notifications : [{ text : string , date : date}]                } 

admin user schema

              {                  ....                   notifications : [{ text : string , date : date}]                } 

service provider schema

              {                  ....                   notifications : [{ text : string , date : date}]                } 

if main user books service of particular service provider, first service booking info stored notification put in service providers notifications array. if service provider online notification should pushed service provider client application.

for trying use socket.io.

my approach

setup of new server push notifications-

server 5 - notification server.

this server runs socket.io server. when ever type of user logs in respective node js application using respective client application, connects notification server after successful login.

now when mainuser books service of particular service provider, main server application put notification particular service providers notification array in document. after send request notification server emit notification on channel specified id of service provider if service provider online receives notification on client application instantly.

but how make sure users connects socket io server legitimate. if user can connect socket io server , listen channel of other user if somehow gets id of other user , notification of other user.what want notification server should @ sessions collection in mongo db database , check if connected user authenticated , has proper user id.

from post i'm assuming using express, express-session , socket.io

you can add middleware socket.io links express session socket.io socket.

the expresssessionmiddleware here instance of "express-session" middleware, should configured identically session middleware in main application.

socketio = require "socket.io" io       = socketio()  io.use (socket, next) ->     expresssessionmiddleware socket.handshake, {}, next 

you have access session on socket.handshake.session

an example module can found here: https://github.com/xpepermint/socket.io-express-session