Skip to content

馃悶[Bug]: Socket.IO Authentication Allows User Impersonation via Client-Supplied userId#4

Description

@Krishnx21

Is there an existing issue for this?

  • I have searched the existing issues

Describe the bug

The Socket.IO authentication middleware verifies JWT tokens but still allows socket connections when token verification fails. Subsequent socket event handlers trust the userId provided by the client payload instead of enforcing the authenticated user identity.

As a result, an unauthenticated or malicious client can send events with arbitrary userId values and potentially impersonate other users.

Expected behavior

Invalid or expired JWT tokens should not be allowed to perform protected socket actions.
User identity should be derived from the verified JWT (socket.userId).
Client-supplied userId values should not be trusted for authorization decisions.
Unauthorized users should not be able to impersonate other users through socket events.

Add ScreenShots

No response

What browsers are you seeing the problem on?

No response

Affected areas:

index.js (Socket.IO authentication middleware)
Socket event handlers using data.userId
Authentication and authorization flow for real-time events

Record

  • I have read the Contributing Guidelines
  • I want to work on this issue

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions