title: How do I secure Socket.IO?
body: <p>I've been working with Socket.IO for a few days and it's been both extremely exciting and even more frustrating. The lack of current documentation/tutorials has made learning it very difficult. I finally managed to create a basic chat system, but there is one glaring question. How do I secure it?</p>
  
  <p>What's stopping a malicious user from copying (or editing) my code and connecting to my server? I can grab the username from my PHP script and submit it to Socket.IO so I can recognize them as that user (and the PHP has security of course), but what's stopping someone from just submitting an unregistered username?</p>
  
  <p>How can I make sure that the events submitted are authentic and haven't been tampered with?</p>
  
  <p>My basic socket.io chat for references.</p>
  
  <p>Server:</p>
  
  <pre><code>var io = require('socket.io').listen(8080);
  var connectCounter = 0;
  io.sockets.on('connection', function (socket) {
  connectCounter++;
   console.log('People online: ', connectCounter);
  
  socket.on('set username', function(username) {
  socket.set('username', username, function() {
  console.log('Connect', username);
  
      });
  });
  socket.on('emit_msg', function (msg) {
      // Get the variable 'username'
  
  socket.get('username', function (err, username) {
        console.log('Chat message by', username);
        io.sockets.volatile.emit( 'broadcast_msg' , username + ': ' + msg );
      });
  
    });
  
  socket.on('disconnect', function() { connectCounter--; });
  });
  </code></pre>
  
  <p>Client:</p>
  
  <pre><code>    &lt;?php session_start() ?&gt;
  &lt;!DOCTYPE html&gt;
  &lt;html lang="en"&gt;
  &lt;head&gt;
      &lt;meta charset="utf-8" /&gt;
      &lt;title&gt;untitled&lt;/title&gt;
  &lt;/head&gt;
  &lt;body&gt;
  &lt;input id='message' type='text'&gt;
  &lt;div id="content"&gt;&lt;/div&gt;
  &lt;script src="http://localhost:8080/socket.io/socket.io.js"&gt;&lt;/script&gt;
  &lt;script src="http://code.jquery.com/jquery-latest.js"&gt;&lt;/script&gt;
  
  &lt;script&gt;
    var socket = io.connect('http://localhost:8080');
  $.ajax({
  type: 'GET',
    url: 'https://mysite.com/execs/login.php?login_check=true',
    dataType: 'json',
     success: function(data) {
  var username = data.username;
  socket.emit('set username', username, function (data){
  });
  
  }
  });
  
    socket.on('broadcast_msg', function (data) {
          console.log('Get broadcasted msg:', data);
          var msg = '&lt;li&gt;' + data + '&lt;/li&gt;';
          $('#content').append(msg);
        });
  
  
  $('#message').keydown(function(e) {
  if(e.keyCode == 13) {
  e.stopPropagation();
            var txt = $(this).val();
            $(this).val('');
            socket.emit('emit_msg', txt, function (data){
              console.log('Emit Broadcast msg', data);
            });
  }
  });
  &lt;/script&gt;
  &lt;/body&gt;
  &lt;/html&gt;
  </code></pre>
  
  <p>It all works dandy, except for having absolutely no security.</p>