Not possible to reject Socket on authorization/authentication

Hello Fellows,

we have a problem about rejecting the socket in case of authorization/authentication validation is failed. Our approach checks the cookie-header in the socket.handshake.headers object in order to validate the session. If the session is not valid, we invoke the next function including an error object to reject the connection. But this does not work. The next function including the Error object will be invoked, but the websocket connection will be still established.

Here is the code:

io.use(function (socket, next){
  if(socket.handshake.headers.cookie){
    socket.cookie = cookie.parse(socket.handshake.headers.cookie);
    sessionID = cookieParser.signedCookie(socket.cookie['connect.sid'],signKey);
    store.get(sessionID,function(err,session){
      if(err){

        next(new Error("Error"));
      }
      else if( typeof session === "undefined"){

        next(new Error("invalid session"));
      }
      else if( session.hasOwnProperty("username")){

         return next();
      }
      next(new Error("invalid session"));
    });

  }
});

Even though there is no valid session, the Google Developer tools displays that a WebSocket connection is successfully established.

The developer tools also shows us the error message denoting us that the next function with the error object was invoked. Even though this error message is shown, the websocket connection is still established.

[peteruithoven]

With a small tweak the socket.disconnect could receive a custom reason… Current implementation:

Socket.prototype.disconnect = function(close){
  if (!this.connected) return this;
  if (close) {
    this.client.disconnect();
  } else {
    this.packet({ type: parser.DISCONNECT });
    this.onclose('server namespace disconnect');
  }
  return this;
};

Small tweak:

Socket.prototype.disconnect = function(close,reason){
  if (!this.connected) return this;
  if (close) {
    this.client.disconnect();
  } else {
    this.packet({ type: parser.DISCONNECT });
    this.onclose(reason || 'server namespace disconnect');
  }
  return this;
};

[svmn]

Any updates on this? For me, it seems insecure that an unauthorized client remains connected to the server.