We Keep Coding

How to add a delay between function excutions

I am creating this little chatbox thing with socket.io, and I am wondering how I can add a delay between message sending to prevent spam and such.
Here is my code for sending a message.
// Sends a chat message
const sendMessage = () => {
let message = $inputMessage.val();
// Prevent markup from being injected into the message
message = cleanInput(message);
// if there is a non-empty message and a socket connection
if (message && connected) {
$inputMessage.val("");
addChatMessage({ username, message });
// tell server to execute 'new message' and send along one parameter
socket.emit("new message", message);
}
};

You could add a variable that tracks the time of the most recently sent message and a comparison of this variable and the current time; if the difference is too small, refuse to send it.
Minimal example:
window.lastMessageTime = 0;
function sendMessage(message) {
if(Date.now() - window.lastMessageTime < 5000)
return false;
window.lastMessageTime = Date.now();
// Proceed
};

Try using setTimeout to execute your main function. Javascript is not supporting any delays as it is single threaded.

Emitting at every second in socket.io don't work

I have a node.js server, on which a socket.io is supposed to emit something every second. But at the client side, the clients get the data more than every 30 seconds. Anybody has any idea why this is happening and what's the solution?
var redis = require("redis"),
client = redis.createClient();
const nsp_page=io.of('/myPage');
nsp_page.on('connection', function(socket){
(function update_index() {
client.get('boxIndex', function (err, data) {
socket.emit('boxIndex',data);
});
setTimeout(update_index,1000);
})();
});
Thanks

But at the client side, the clients get the data more than every 30 seconds. Anybody has any idea why this is happening and what's the solution?
Because your code sends the data every second. This line of code:
setTimeout(update_index,1000);
Causes it to call udpate_index() every second, not every 30 seconds. If you want it to update every 30 seconds, you would change that to this:
setTimeout(update_index, 30 * 1000);
But, note that the way your code works is very inefficient because you're calling the exact same client.get() for every single connected client. That's really inefficient. It would make more sense to call client.get() once and then broadcast that data to every connected client:
const redis = require("redis");
const client = redis.createClient();
const nsp_page = io.of('/myPage');
setInterval(() => {
client.get('boxIndex', function (err, data) {
if (err) {
console.log("boxIndex not found", err);
} else {
// send to all connected clients
nsp_page.emit('boxIndex', data);
}
});
}, 30 * 1000)
When you have lots of connected clients, this will do only one query of your redis database every 30 seconds and use that result for all clients instead of calling redis separately for every single connected client.

socket io js delay disconnect emit

socket.on('disconnect') is fired immediately on client side, but server side it will take one minute.
scenario 1:- if client is disconnect due to internet problem, server side disconnect emits after 1 minutes, any way to find immediately on server side.
i tried to change the pingTimeout= 30000 and pingInterval=12000 but every 30 seconds it reconnecting and connect.

You can use a timeout delay and the socket disconnection event to make it easier to disconnect and reconnect.
When your socket connects, add them to a bucket object.
if (socket.request.sessionID && !bucket[socket.request.sessionID]) {
bucket[socket.request.session.player.id] = socket.id; //nuuu they stealin mah bukkit
}
This adds the player's id (which I track through node session tethered into the socket) as a key to the socketId
//object for delayed log out
let disconnection = {
sid : null, //socket id
delay : null //timeout id
};
Create an object that stores your socket ID so you can track who was disconnected.
socket.on('disconnect', function () {
disconnection.sid = socket.request.sessionID; //grab session id
disconnection.delay = setTimeout(() => {
//set timeout to variable, in case of reconnection
delete bucket[socket.request.sessionID];
//emit the disconnection event
}, 60000);
});
When the user disconnects, set a timeout for however long they have to reconnect.
Upon reconnection, simply do:
io.sockets.on("connection", socket => {
//check for disconnection, compare socket ids, and remove timeout if sockets match
if (disconnection.delay && disconnection.sid == socket.request.sessionID) {
clearTimeout(disconnection.delay);
disconnection.sid = null;
}
});
This will check the reconnection for an existing socketID and clear the timeout, successfully establishing the connection once more.
Note that this code is a copy of SourceUndead (my game) so some of it might not directly translate to you (for instance, my socket variable is bound with the session as well), but the concept of a timeout disconnection is the same.

Socket.io message event firing multiple times

I was trying to learn node and started creating a mashup with socket.io
The message transportation have begin but I have run into some trouble.
The message event is firing multiple times leading to a single message appearing multiple times on the recipient's box. I have routed the socket to exports.chat and was wondering if that is causing the problem?
To narrow down the problem: the messages are firing the number of times = the sequence of connection of the client. That is, if a client connects second, his messages will fire twice. three times for the client connecting third.
Here is the code snippet:
exports.chat = function(io, pseudoArray, req, res){
res.render('chat', {title: 'ChatPanel.'});
var users = 0;
io.sockets.on('connection', function (socket) { // First connection
users += 1;
// reloadUsers(io, users);
socket.on('message', function (data) { // Broadcast the message to all
if(pseudoSet(socket)) {
var transmit = {date : new Date().toISOString(), pseudo : returnPseudo(socket), message : data};
socket.broadcast.emit('message', transmit);
console.log("user "+ transmit['pseudo'] +" said \""+data+"\"");
}
});
socket.set('pseudo', req.session.user, function(){
pseudoArray.push(req.session.user);
socket.emit('pseudoStatus', 'ok');
console.log("user " + req.session.user + " connected");
});
socket.on('disconnect', function () { // Disconnection of the client
users -= 1;
// reloadUsers();
if (pseudoSet(socket)) {
var pseudo;
socket.get('pseudo', function(err, name) {
pseudo = name;
});
var index = pseudoArray.indexOf(pseudo);
pseudo.slice(index - 1, 1);
}
});
});
};

The whole part of socket.io code has to go outside external.chat function. Socket IO has to bind with the http/app server, you should not handle it within each request.
the messages are firing the number of times = the sequence of connection of the client
What essentially happening is, each time a new request arrives you are registering a event handler for message, hence it is fired as many times as the you have accessed chat URL.
io.socket.on('message', function (data) {...})

So I had the same problem. The solution is to close all your listeners on the socket.on('disconnect') event, this is what my code looks like -
socket.on('disconnect', function () {
socket.removeAllListeners('send message');
socket.removeAllListeners('disconnect');
io.removeAllListeners('connection');
});
Might not need to call it on disconnect, not sure but I do it anyway.

I think this misbehavior is because you are attempting to use one of the handful of built-in/reserved event names "message" as an application-specific message. To confirm, change your event name to "message2" or something else and see if the problem goes away. I believe at least "connect", "disconnect", and "message" are reserved. https://github.com/LearnBoost/socket.io/wiki/Exposed-events

Link: https://socket.io/docs/v3/listening-to-events/#socketoffeventname-listener
Please use socket.off method to removes the specified listener from the listener array for the event named eventName.
socket.off("message").on("message", this.UpdateChat);

Restarting the server can be responsible for several identical event listeners on the client side. If the client has not reloaded (restarted) you have to make sure that the old event listeners are deleted on the client side when establishing a new connection. You can do that with
io.socket.removeAllListeners()

SOCKET.IO v3.x
I don't really know why reserve event in socket.io are firing up multiple times, hence I make a logic that fits to our needs and address this problem,
I simply create a global mutable value that could change everytime the 'disconnect' fire up, here's the logic I did
let ACTIVE_USERS = []; //assume the propery of an object is { name, socket_id }
const connections = (socket) => {
socket.on("disconnect", (reason) => {
//lets check how many times it fires up
console.log('YOW', reason);
//mutate the ACTIVE_USERS
ACTIVE_USERS = ACTIVE_USERS .filter(user => {
//lets figure it out if this thing helps us
if(user.socket_id === socket.id){
console.log('HEY!!!');
socket.broadcast.emit('disconnected-user',[
message: `${user.name} has been disconnected`
})
}
})
});
}
and the result of it is here

How can I prevent malicious use of my sockets?

I'm making a webpage based around players being able to invite other players to parties, and other things a long the lines.
I have your basic send / receive / update of the chat/users in your party. The only thing is, what's to stop somebody from sitting there opening up a developer console and going
socket.emit('updateUsers', 'Weiner');
socket.emit('updateUsers', 'Idiot');
socket.emit('updateUsers', 'Bad word');
socket.emit('updateUsers', 'Other stupid malicious really long spam the chat name');
How can I prevent against this so that they can not do such things?
(Full JS Stack, Node.js)
Thanks!

I faced this problem aswell, This was my solution as far as spamming emits go (malicious socket use)..
var spamData = new Object();
var spamCheckFunctions = ["updateUsers","moreEmits"]; // anti-spam will check these socket emits
var antiSpam = 3000; // anti spam check per milliseconds
var antiSpamRemove = 3; // -spam points per antiSpam check
var maxSpam = 9; // Max spam points before disconnect is thrown to the socket
io.sockets.on('connection', function (socket) {
// Spam Check, this binds to all emits
var emit = socket.emit;
socket.emit = function() {
data = Array.prototype.slice.call(arguments);
if(spamCheckFunctions.contains(data[0])){
addSpam(socket);
};
emit.apply(socket, arguments);
};
var $emit = socket.$emit;
socket.$emit = function() {
data = Array.prototype.slice.call(arguments);
if(spamCheckFunctions.contains(data[0])){
addSpam(socket);
}
$emit.apply(socket, arguments);
};
});
function maxSpamCheck(socket){
if(spamData[socket.username].spamScore>=maxSpam && !socket.spamViolated){
socket.spamViolated = true;
socket.disconnect();
}
}
function checkSpam(){
for(user in spamData){
if(spamData[user].spamScore>=1) spamData[user].spamScore-=antiSpamRemove;
}
return;
}
setInterval(checkSpam,antiSpam);
function addSpam(socket){
if(socket.spamViolated) return;
spamData[socket.username].spamScore+=1;
maxSpamCheck(socket);
}
// Then add this where your user is authenticated
function authenticate(socket){
socket.username = username // here you define username
socket.spamViolated = false;
spamData[socket.username] = {
spamScore: 0
}
}
Array.prototype.contains = function(k) {
for(var p in this)
if(this[p] === k)
return true;
return false;
};
basically binds to all emits and checks if the emit name is contained in spamCheckFunctions if it is it will add a spam point, if a user exceeds a spam score amount (maxSpam); he will be disconnected. And for every milliseconds defined at antiSpam will minus the user spam score defined at antiSpamRemove
I'm sure there are cleaner solutions but this one worked out pretty good for me :)
Just make sure to verify/authenticate the users.
this is how I authenticate them (not using nodejs as a webserver, but had django):
io.configure(function(){
io.set('authorization', function(data, accept){
if(data.headers.cookie){
data.cookie = cookie_reader.parse(data.headers.cookie);
return accept(null, true);
}
return accept('error', false);
});
});
now you can access socket.handshake.cookie['sessionid'] (in my case this worked with django)
then match the socket.handshake.cookie['sessionid'] with a entry where your sessions are stored on the webserver

That's a difficult problem in general. Two things you could do:
1) Use self-invoking functions on the client side, i.e.
(function(w) {
// define your sockets here
var socket = ...;
})(window);
Obviously it is on the client side so this is not really secure. But it's not bad to have such wall.
2) On the server side keep track of the frequency of posting. For example if someone posts 5 times in a second, then you can assume that it is a spam and you could block that socket. It is especially effective if combined with authentication and complex registration (so people will have problem in creating new account).

Use an md5/sha key which behaves like a cookie.
Generate a key for a specific user and send it to the client and always check that incoming requests have the same key
It won't be completely secure since the hacker can always find your key in either the source code or localStorage but try to hide it through obfuscation of your code

A way to prevent spam is to either implement user authentication and/or a packet rate limiter. Add a middleware function which keeps track of the socketId and the amount of packets being sent through that socket. When it exceeds your limit disconnect the socket.
You can even add an extra function which keeps track of the IP address of that socket, if an IP address will be disconnected too often due spam you can ban that ip. Add a check on your connection event which IP addresses are allowed.

Use rate-limiter-flexible package for limiting number of events per second. Limiting by IP is the most simple, but would be better to limit by userId if possible.
const app = require('http').createServer();
const io = require('socket.io')(app);
const { RateLimiterMemory } = require('rate-limiter-flexible');
app.listen(3000);
const rateLimiter = new RateLimiterMemory(
{
points: 5, // 5 points
duration: 1, // per second
});
io.on('connection', (socket) => {
socket.on('bcast', async (data) => {
try {
await rateLimiter.consume(socket.handshake.address); // consume 1 point per event from IP
socket.emit('news', { 'data': data });
socket.broadcast.emit('news', { 'data': data });
} catch(rejRes) {
// no available points to consume
// emit error or warning message
socket.emit('blocked', { 'retry-ms': rejRes.msBeforeNext });
}
});
});
Read more in official docs