Secure backend socket.io from other applications that can access localhost i.e. browser

[vinkabuki]

https://stackoverflow.com/questions/14600472/securing-socket-io

[vinkabuki]

https://stackoverflow.com/questions/40009917/end-to-end-encrypt-a-socket-io-chat-application

[holmesworcester]

what's the threat here? can other apps running on the same device see network traffic?

[vinkabuki]

@holmesworcester not sure about if other apps can see this, afair not, but also I think other app can connect to our socket so it's even worse, but I am again not 100% sure, but I don't see any reason against it

[holmesworcester]

Note: we can generate a token in the frontend and send it to the backend, or we could use a socket instead. The main thing to protect against is the browser. See: https://en.wikipedia.org/wiki/Cross-site_request_forgery#Example

[holmesworcester]

Note: we should fix these on master and release an update before 2.0

[Kacper-RF]

#1940