How to filter clients with the origin? about websocket.io

[rauchg]

Great question

[arunoda]

BTW: I just figure it out origin header has no use at all
http://learnitcorrect.com/blog/websocket-is-great-but-not-the-origin-policy.html

[rauchg]

It does have an use, see the comment by @saurik. Of course anyone can create a new request with any Origin whatsoever from their terminal, but the key is can the website the user is visiting do it ?

[arunoda]

Yes. he is correct.
So how about a API like this?

var options = {
  allowOrigin: function(origin) {
     return true;
  }
};

var ws = require('websocket.io')
  , server = ws.listen(3000, null, options);

server.on('connection', function (socket) {
  socket.on('message', function () { });
  socket.on('close', function () { });
});

[rauchg]

Async maybe ?
And called originCheck ?

[arunoda]

Sounds good to me.
And this should be optional right?

var options = {
  originCheck: function(origin, confirm) {
     confirm(true);
  }
};

var ws = require('websocket.io')
  , server = ws.listen(3000, null, options);

server.on('connection', function (socket) {
  socket.on('message', function () { });
  socket.on('close', function () { });
});

[rauchg]

Correct.

If falsy, accepts the origin.
If function, supplies the origin and callback.

[arunoda]

awesome.