JavaScript code substitution on client side

Question

I'm now learning some new technologies (such as node.js, socket.io, redis etc.) and making some simple test applications to see how it can work.

My question is about security on a client-side javascript code: for example, i have a chat-server on node.js+express and when a user connects to this chat, server should assign his registred username (authorisation through oldschool php+mysql is used) to his socket. The question is, can user modify his client-side script and connect to chat under different users' names?

Some code is given below:

(server-side part of assigning username, which is just getting the username from client-side call)

// when the client emits 'adduser', this listens and executes
socket.on('adduser', function(username){
    // store the username in the socket session for this client
    socket.username = username;
    // store the room name in the socket session for this client
    socket.room = 'General';
    // add the client's username to the global list
    usernames[username] = username;
    // send client to room 1
    socket.join('General');
    // echo to client they've connected
    socket.emit('updatechat', 'SERVER', 'you have connected to General');
    // echo to room 1 that a person has connected to their room
    socket.broadcast.to('General').emit('updatechat', 'SERVER', username + ' has connected to this room');
    socket.emit('updaterooms', rooms, 'General');
});

(client-side part of sending username to server, it looks like 'var username = "User";' for a particular user)

Yii::$app->view->registerJs('var username = "'.$user->identity->username.'";', yii\web\View::POS_HEAD);

(connect function)

chat.on('connect', function(){
        // call the server-side function 'adduser' and send one parameter (value of prompt)
        chat.emit('adduser', username);
});

SO the question is: can user change (for example, through chrome development tools) his username in line 'var username ...' and connect to chat under the different name?

P.S. this particular situation is just an example, obviously, changed nicknames in chat are not more than a simple joke, but similar situations can appear in other projects...

Answer 1

Supposing your variables are protected in closures and that it's not trivial to change them by typing username='root' in the console, a user could simply replace the whole code.

Everything that happens client side is totally out of your control.

The good news is that they are solutions not involving a duplicate authentication. Supposing you already authenticate the user in your express application, you can get the session and the user from that.

See how I do it in my chat server :

var sessionSockets = new SessionSockets(io, sessionStore, cookieParser);
sessionSockets.on('connection', function (err, socket, session) {
    function die(err){
        console.log('ERR', err);
        socket.emit('error', err.toString());
        socket.disconnect();
    }
    if (! (session && session.passport && session.passport.user && session.room)) return die ('invalid session');
    var userId = session.passport.user;
    if (!userId) return die('no authenticated user in session');
    ... handling socket for authenticated user
});

Basically, it uses the session.socket.io module to propagate the session from the standard http requests (authenticated using passport) to the socket.io connection. And everything that isn't supposed to be provided by the user is taken from the session/db/server.