added a random auth token mechanism to have some sort of authentication between websocket client and server

Author: Daniel Hochleitner

README.md

@@ -18,6 +18,7 @@
   - [Usage](#usage)
     - [Node.js Server](#nodejs-server)
     - [REST-Service](#rest-service)
+    - [PL/SQL API](#plsql-api)
     - [APEX](#apex)
   - [License](#license)
 
@@ -47,8 +48,12 @@ Developers don´t need to be experts in Javascript or JQuery and stuff like that
 A demo application is available under
 https://apex.danielh.de/ords/f?p=WSNOTIFY
 
-And of course you find a APEX export (demo_app.sql) of it in [../apex/](https://github.com/Dani3lSun/apex-websocket-notify-bundle/tree/master/apex) folder. To use it just import the app and then go through the installation steps below.
-Under Shared Components --> Edit Application Definition --> Substitutions Strings, set "G_WS_SERVER_HOST" to the hostname or ip address and "G_WS_SERVER_PORT" to the port of your node notification server.
+And of course you find a APEX export (**demo_app.sql**) of it in [../apex/](https://github.com/Dani3lSun/apex-websocket-notify-bundle/tree/master/apex) folder. To use it just import the app and then go through the installation steps below.
+Under Shared Components --> Edit Application Definition --> Substitutions Strings, set
+
+- **G_WS_SERVER_HOST** to the hostname or ip address of your node notification server
+- **G_WS_SERVER_PORT** to the port of your node notification server
+- **G_WS_SERVER_AUTHTOKEN** to your secure and random authToken of your node notification server (read further for more informations)
 
 The demo includes all plugins and shows the most common preferences and possibilities.
 
@@ -129,7 +134,8 @@ You can change the default behavior of the server by editing the JSON config fil
     },
     "socket": {
         "private": true, // activate private websocket room/namespace of server
-        "public": true // activate public websocket room/namespace of server
+        "public": true, // activate public websocket room/namespace of server
+        "authToken":"please-change-me" // authentication token, client should have the same to connect with websocket, please change it to some random string
     }
 }
 ```
@@ -272,16 +278,20 @@ http://[host-ip-of-server]:[port]/notifyuser
   - **notify-title** (required) - Title of notification
   - **notify-message** (required) - Message content of notification
 
-A demo call using curl could look like this:
+A demo call using curl looks like this:
 
 ```
 curl -H "notify-title: Test Title Text" -H "notify-message: Test Message Text" "http://[host-ip-of-server]:[port]/notifyuser?userid=daniel&room=private&type=info&optparam=myoptionalinfo123"
 ```
 
+### PL/SQL API
+
+
 
 ### APEX
 
+
+
 ## License
-This software is under **MIT License**.
 
----
+This software is under **MIT License**.

apex/demo_app.sql

@@ -14,7 +14,8 @@
 	<script type="text/javascript">
 		// connect info
 		var userid = 'daniel';
-		var connectString = 'userid=' + userid;
+		var authToken = 'please-change-me';
+		var connectString = 'userid=' + userid + '&authtoken=' + authToken;
 		console.log(connectString);
 		// connect to sockets
 		var privateSocket = io.connect('/private', {
@@ -40,6 +41,14 @@
 			console.log('time', data.time);
 			console.log('optparam', data.optparam);
 		});
+		// socket disconnect events
+		// socket message events
+		privateSocket.on('disconnect', function() {
+			console.log('private-socket disconnected');
+		});
+		publicSocket.on('disconnect', function() {
+			console.log('public-socket disconnected');
+		});
 	</script>
 
 </body>

apex/plugins/dynamic_action_plugin_de_danielh_initwsnotifyconnection.sql

@@ -31,9 +31,11 @@ module.exports = {
         } else if (pType == 'socket') {
             var lPrivate = jsonObject.socket.private;
             var lPublic = jsonObject.socket.public;
+            var lAuthToken = jsonObject.socket.authToken;
             return {
                 private: lPrivate,
-                public: lPublic
+                public: lPublic,
+                authToken: lAuthToken
             };
         }
     },

node/node-notify-server/client.html

@@ -10,6 +10,7 @@
     },
     "socket": {
         "private": true,
-        "public": true
+        "public": true,
+        "authToken":"please-change-me"
     }
 }

node/node-notify-server/prefs.js

@@ -15,6 +15,7 @@ var sslKeyPath = serverPrefs.sslKeyPath;
 var sslCertPath = serverPrefs.sslCertPath;
 var isPrivate = socketPrefs.private;
 var isPublic = socketPrefs.public;
+var socketAuthToken = socketPrefs.authToken;
 var server;
 // Create HTTP Server
 // SSL HTTP
@@ -172,28 +173,50 @@ var socketio = {
         if (isPrivate) {
             ioPrivate.on('connection', function(socket) {
                 var userid = socket.handshake.query.userid;
-                socket.userid = userid;
-                // logging
-                prefs.doLog(userid + ' connected to Private');
-                // save session
-                localstore.saveUserSession(userid, 'private', socket.id, function() {
+                var authToken = socket.handshake.query.authtoken;
+                // check authToken
+                if (authToken == socketAuthToken) {
+                    // token success
+                    socket.userid = userid;
                     // logging
-                    prefs.doLog(userid + ' private session saved in DB');
-                });
+                    prefs.doLog(userid + ' connected to Private');
+                    // save session
+                    localstore.saveUserSession(userid, 'private', socket.id, function() {
+                        // logging
+                        prefs.doLog(userid + ' private session saved in DB');
+                    });
+                } else {
+                    // token error
+                    // logging
+                    prefs.doLog(userid + ' with wrong authToken: ' + authToken);
+                    // disconnect
+                    socket.disconnect();
+                }
             });
         }
         // Public connect
         if (isPublic) {
             ioPublic.on('connection', function(socket) {
                 var userid = socket.handshake.query.userid;
-                socket.userid = userid;
-                // logging
-                prefs.doLog(userid + ' connected to Public');
-                // save session
-                localstore.saveUserSession(userid, 'public', socket.id, function() {
+                var authToken = socket.handshake.query.authtoken;
+                // check authToken
+                if (authToken == socketAuthToken) {
+                    // token success
+                    socket.userid = userid;
                     // logging
-                    prefs.doLog(userid + ' public session saved in DB');
-                });
+                    prefs.doLog(userid + ' connected to Public');
+                    // save session
+                    localstore.saveUserSession(userid, 'public', socket.id, function() {
+                        // logging
+                        prefs.doLog(userid + ' public session saved in DB');
+                    });
+                } else {
+                    // token error
+                    // logging
+                    prefs.doLog(userid + ' with wrong authToken: ' + authToken);
+                    // disconnect
+                    socket.disconnect();
+                }
             });
         }
     },