Feature Request: Add negotiation (redirect, token) mechanism on client and server
Open
Nobody has claimed this yet.
enhancement
- Dominant language
- TypeScript
- Stars
- 63.2k
- Forks
- 10.3k
- Avg merge
- 11d 20h
- Merged PRs (30d)
- 2
Description
Feature description and some design details
It's a feature request about adding a negotiation mechanism.
- In server side, the negotiation can expose a path e.g.
/negotiateand response a JSON:
{
"url": "<url>",
"token": "<token>"
}
- In the client side, we can expose a negotiate factory:
new io(negotiateFactory: async () => await negotiateAsync());And client read and parse the JSON, and then it can make connection according to the negotiation result. urlis required for client to make connection andtokencan be set inAuthorizationheader for long polling andaccess_tokenquery string for websocket (websocket only support limited headers).- The client does a new negotiation when reconnecting.
- This feature is optional in both server side and client side.
The reason why I want to add this feature
The feature benefits some scenarios:
- Clients need to be sharded into different groups of servers: Server or even just a negotiation server which only responsible for negotiation can use the negotiation mechanism to redirect the client to different
tokencan be used to secure and auth the Engine.IO connection. Nowadays most of the auth is applied on Socket.IO level. But anyway an attacker can make Engine.IO connection without any auth to consume server's resource. Add a token upon Engine.IO connection and server can verify and reject it inio.engine.use()middleware. And negotiate every reconnection make sure you can refresh the token.- Cloud provider scenarios: Cloud providers usually add a broker between client and servers. Add a negotiate let the server have chances to redirect clients to the cloud providers seamlessly. Consider clients enabled negotiate and the
urlpoint to the server directly first, and server can update and change it's negotiate result to redirect client to cloud provider (brokers) without changing any codes in clients.
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
The issue names no files or tests, so start by tracing the existing client connection and reconnection flow alongside the server Engine.IO middleware. Use /negotiate, negotiateFactory, Authorization, access_token, and io.engine.use() as the acceptance surface. Done means optional negotiation works on both sides, runs again on reconnect, and preserves current behavior when disabled.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- node.js, typescript
- Domain
- api, backend-api-design, full-stack
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100