martindale/soundtrack.io — pull request #5 by pantlesswonder (2013-07-14 01:51:30+00:00)
Title: Add socket auth

Ok this adds socket authentication. Here's how it works:
1) Client connects to websocket
2) Client requests token over ajax
3) Server generates time-sensitive, single-use token and sends it back to the client
4) Client replays that token over the websocket
5) Server gets that token and looks it up...
5a) If the token exists, it authenticates the connection
5b) If the token doesn't exist, it closes the connection

It doesn't clean up old tokens out of the socketAuthTokens, so that's kind of lame.
This whole codebase really needs to get refactored (make it easier to add socket communication and listeners) and all of the comms that can be pushed over the websocket probably should go that way.

I'm also not sure why it doesn't use proper websockets, and uses XHR polling all the time...