client can connect to non-existing namespaces and takes server resources

[ofirzh]

client can connect to non-existing namespaces and takes server resources.
unwanted connections should be dropped.
Thanks,
Ofir

[csulok]

+1

[nkzawa]

What version of socket.io do you use? This is already fixed in the latest version.

[ofirzh]

"socket.io": "1.2.0"

[mahmalsami]

Is somebody still dealing with this issue ?

i'm using the 1.3.5 version, and on:
io("http://localhost:9000/whatever-name");

still, the server is actually opening a connexion. Any solution ?
Client Side, I don't get any 'connect_failed' nor 'disconnect' event.

if i understand this MR #1688, the expected behavior is to disconnect the client.

[mfchung]

1.3.6, issue still exists

[Haocen]

Given the fact if each namespace is setup properly/authenticated properly, nobody should connected only to root namespace.
Here is my temporary fix without modifying Socket.io behavior:

socketIo.use((socket, next) => {
    setTimeout(() => {
      const namespaces = Object.keys(socket.client.nsps);
      if (namespaces.length === 1) {
        socket.disconnect();
        logger.warn(`Forbidden: ${socket.request.connection.remoteAddress} connected to root namespace only.`);
      }
      else {
        Object.keys(socket.client.nsps).filter(namespace => namespace !== '/').forEach((namespace) => {
          if (!['/namespaceA', '/namespaceB'].includes(namespace)) {
            socket.disconnect();
            logger.warn(`Forbidden: ${socket.request.connection.remoteAddress} connected to non-exist namespace.`);
          }
        });
      }
    }, 15000);
    next();
  });

socketIo here has to be in root Socket.io namespace, before calling any .of() or .in().

[kuige]

2.3.0, issue still exists

4.6.1 Still existing

I don't think @Haocen solution will work anymore since io.use is now an alias for io.of('/').use. The only thing that comes in mind is a global middleware with io.engine.use((req, res, next) => {}) but is there any way to check the requested namespace in the req object?

I think that this bug can bring to a useless waste of resources on the server, and even potential security issues. This should be reopened @darrachequesne. Shouldn't be clients able to connect only on server already declared namespaces?

[darrachequesne]

@giovanni-bertoncelli

Shouldn't be clients able to connect only on server already declared namespaces?

That's the case. Are you experiencing a different behavior?

Regarding the initial issue, there is now a process that automatically disconnect clients that have not joined a namespace (91cd255), added in version 3.0.0.

I can try to reproduce it