SignalR/SignalR — Issue #237: Need to secure round-tripped data, e.g. groups, connectionId
Author: DamianEdwards
Created: 2012-03-08 18:14:43+00:00
State: open
Labels: feature

There are a number of pieces of data that originate from the server that are round-tripped to the client and back that govern things like the connection ID and membership of groups. Although it can be protected from snooping via SSL, this information is currently not secured against tampering in any way, so a client can potentially masquerade as another user if it knows that user's current connection ID, or say they're in a group they were never explicitly added to.

To fix this, we need to encrypt/sign this information so that clients can't tamper with the data.