Is there an existing issue for this?
Describe the bug
The Socket.IO authentication middleware verifies JWT tokens but still allows socket connections when token verification fails. Subsequent socket event handlers trust the userId provided by the client payload instead of enforcing the authenticated user identity.
As a result, an unauthenticated or malicious client can send events with arbitrary userId values and potentially impersonate other users.
Expected behavior
Invalid or expired JWT tokens should not be allowed to perform protected socket actions.
User identity should be derived from the verified JWT (socket.userId).
Client-supplied userId values should not be trusted for authorization decisions.
Unauthorized users should not be able to impersonate other users through socket events.
Add ScreenShots
No response
What browsers are you seeing the problem on?
No response
Affected areas:
index.js (Socket.IO authentication middleware)
Socket event handlers using data.userId
Authentication and authorization flow for real-time events
Record
Is there an existing issue for this?
Describe the bug
The Socket.IO authentication middleware verifies JWT tokens but still allows socket connections when token verification fails. Subsequent socket event handlers trust the userId provided by the client payload instead of enforcing the authenticated user identity.
As a result, an unauthenticated or malicious client can send events with arbitrary userId values and potentially impersonate other users.
Expected behavior
Invalid or expired JWT tokens should not be allowed to perform protected socket actions.
User identity should be derived from the verified JWT (socket.userId).
Client-supplied userId values should not be trusted for authorization decisions.
Unauthorized users should not be able to impersonate other users through socket events.
Add ScreenShots
No response
What browsers are you seeing the problem on?
No response
Affected areas:
index.js (Socket.IO authentication middleware)
Socket event handlers using data.userId
Authentication and authorization flow for real-time events
Record