LearnBoost/socket.io — pull request #1039 by cantlin (2012-09-24 14:43:19+00:00)
Title: Optionally drop requests to existing transport instances from IP addresses not matching the original request IP

This addresses #619, and is based on an earlier pull request by @coolbloke1324: https://github.com/LearnBoost/socket.io/pull/624.

The issue here is to do with what happens when a naive HTTP request comes in that looks like a socket.io URI, and uses the ID of an existing transport, but does not contain an upgrade header. Due to some ISP nastiness noted in the original thread a few of us are seeing this happening and it's killing our sockets. You can replicate the problem by firing up a server/client and exchanging a few packets via WS, then from a different IP requesting the socket URI, e.g.:

$ curl -v clients.howoco.com/socket.io/1/websocket/Ot1dfZBv669zk_3Iqgng

Using the current master, you'll see:

debug - setting request GET /socket.io/1/websocket/aNxI9AohIcm4Z3hqbIb1
debug - set heartbeat interval for client aNxI9AohIcm4Z3hqbIb1
warn - websocket connection invalid
info - transport end (undefined)

Which is pretty much right ([here's the line](https://github.com/LearnBoost/socket.io/blob/master/lib/transports/websocket/default.js#L86) responsible).

Still, in practise it seems like in most cases we don't want requests coming from some random third party IP addresses to be able to close legitimate connections. This pull adds a setting to make socket.io behave like this.