7

I have read through the w3 spec @ http://www.w3.org/TR/eventsource/ for how EventSource/SSE works, but I cant find any good information about how a private stream should be created.

Basically, I want to create a way to send private data to specific user-sessions. Both the ideas below seems to do what I want, but I am not so sure how secure they are.

Example; does every browser connecting to the same EventSource URL receive the same data, and the browser keeps track of what event-name it wants?

var source = new EventSource('/stream');
source.addEventListener('l0ngr4nd0mSessionID', function(e){
    console.log('Received a private message:', e.data);
});

Will anyone without the event-name of l0ngr4nd0mSessionID be able to get this message?

What about this case;

var source = new EventSource('/stream/l0ngr4nd0mSessionID ');
source.addEventListener('private', function(e){
    console.log('Received a private message:', e.data);
});

Is these examples just as good as setting the withCredentials option? My sse server is a seperate server than the main web-server, so I would prefeer to not send authentication-data using withCredentials and rather use one of the examples.

2 Answers 2

21

Each stream is private. SSE is not a broadcast technology (unless you deliberately implement it as such). Instead each browser client is given a dedicated socket connection to your server. Your server will use a concurrent event handler to deal with just that client, and will choose what information it wants to send to that client. You get that client's cookies too, so can identify their session, and basic authentication also works.

Everything gets much more complex when CORS gets involved, i.e. if your SSE server is not the same origin as where the HTML was served from. That is the situation you described. Your server will have to send back "Access-Control-Allow-Origin: *", but you do not need to use withCredentials if you are happy to send that unique sessionID. But note that you will not get cookies or basic auth data.

Going back to your question, the first example is bad. It implies your server is broadcasting private data to all clients. As well as the privacy issue, that is also a horrible waste of bandwidth.

Your second approach is better: you are using something in the URL to identify the data the user should receive, in lieu of using a cookie or authentication. Note that anyone who knows this URL can get the same data. SSL will not help. I'm guessing your session ID is something that they get when logging in to your main web site, and that it expires when they log-out. For most situations I think this is Good Enough: a hacker has to go to quite a lot of trouble for a relatively short window of access. In other words it is easier to use social engineering to get the user's auth details. But you need to do your own risk/benefit evaluation.

The most secure approach is to use SSL with cookies or basic auth. This is easy if web server and streaming server are the same origin; otherwise you need to use withCredentials.

6
  • Thanks for an informative answer. I prefer not to use #2 because it will end up in web/proxy logs that logs the requesting url. But are you saying that #1 is unsecure and everyone listening to the /stream can technically see the data..? In that case, the only thing left is withCredentials.. Everything is using SSL..
    – xeor
    Dec 3, 2013 at 8:53
  • 1
    Yes, #1 is a misunderstanding of how SSE works: the server never gets to see the event listener you listen on. The only chance you have to pass information to the server is the initial request. Also you cannot send POST data, so it always ends up in the server logs. (Well, you can customize the server logs to not log that, but as you say that does not cover proxies.) Dec 3, 2013 at 9:47
  • I know that the server doesn't know what is being listened to. But the server is able to know when to send to which r4nd0mID. What I dont understand is how the server can, with using something like sse.add_message("private", 'abc') send a private message to a user. Thinking about it, this is probably what SSE channels is for? In eg. github.com/niwibe/django-sse, they have a sense of channels. But I done see that in the SSE standard.
    – xeor
    Dec 3, 2013 at 12:27
  • hmm, never mind. The last comment was a little brain-fart, and me not thinking correctly. The correct way is off course to 1) Verify authentication 2) Just send out data that the specific ID wants.. Since SSE is not a broadcast solution (which I thought in the beginning, and you said), this will work, and be secure.
    – xeor
    Dec 3, 2013 at 14:09
  • Are you sure about the dedicated thread part? It seems a lot of web frameworks can handle more streaming connections than the machine can open dedicated threads by some orders of magnitude. See elixir + phoenix, spring + flux + netty, etc.
    – nurettin
    Dec 27, 2018 at 7:37
0

The privacy of SSE data is really dependent on algorithm you design.

Basically, the browser can reaching connection via URL without a hidden KEY & ID : new EventSource('XXX");

Putting KEY-ID to URL is still has highly exposure risk.

It's good to design some hidden deal between server and client to secure the stream data:

  • Add a counter on server to allow only 1 SSE receiver connect. Each connection have a different address.
  • Encrypt data with a key which the key is shared in a safer transferring method. (POST XMLhttp)
  • Display content in an iframe with sandbox
  • Recognize client device configuration (OS, browser) to filt other device.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.