Is it OK to pass both token and client_id to the c

Question

I need to create an application, where GAE server will always talk with just one client (i.e. one message should be always sent just to one client).

I do the following -

Python:

def get(self):
    # generate token, when page is loaded
    client_id = uuid.uuid4().hex
    token = channel.create_channel(client_id)
    template_values = {'token': token,
                       'client_id': client_id
                       }
    self.response.out.write(template.render('page.html', template_values))

def post(self):
    # reply to the client
    ... 
    client_id = self.request.get('id')
    channel.send_message(client_id, message)

Javascript:

sendMessage = function(field) {
  $.ajax({
    type: "POST",
    url: "/",
    data: "f=" + field + "&id=" + "{{ client_id }}", // WARNING!
    contentType: "application/x-www-form-urlencoded",
    success: function(data) {
    }
  });          
};

onOpened = function() {
  connected = true;
  sendMessage('opened');
};
onMessage = function(msg) {
  alert(msg.data);
};
onError = function(err) {
  alert(err);
};        
onClose = function() {
  alert("close");
};        
// open new session
channel = new goog.appengine.Channel('{{ token }}'); // WARNING!
socket = channel.open();
socket.onopen = onOpened;
socket.onmessage = onMessage;
socket.onerror = onError;
socket.onclose = onClose;

It works well, but with such scenario both token and client_id are passed to the client. Is it OK?

Answer 1

There's no technical reason not to do this. If you're worried about security, the token is far more valuable: an attacker who could listen to your traffic could take the token and listen to channel messages in a different context. The clientid wouldn't let them do that.

But I do have a question: why not return the message in the POST response, rather than sending a message over the channel? Or is the sample code just simplified for the example?