Tuesday 25 April 2017

Socket.io - CLIENT SCRIPT authenticating with a website login

I made a nodeJS script to automate a few actions on a website - which is not mine!To have a bit more control over what is going on, I would like to listen to the events on the website's socket.io stream.Works in NODE so far:Logging into the website and receiving their cookies as a string for further requestsSending requests with the cookies from the login (do the actual actions)Open a websocket connection and listen to the public (!) eventsDoesn't work in NODE yet:Read "private" events that are only being sent to a specific user (me)I inspected a XHR request that is happening in chrome when clicking a specific button on this website. After this request has been sent, the websocket connection on chrome emits events about the status of my action. Of course, these events are only being sent to the user who performed this action.Doing the exact same request in node (with the cookies from the website login) gives the right response (success), but the socket stream i opened before, only shows some public events - nothing about my actions.As seen here, it logs in, displays the website's cookies, opens a socket stream. Then it sends a XHR POST request with the displayed cookies in the headers. The response says "success", but the socket.io events popping up once a second are only the public ones (userCount).http://ift.tt/2q2a1lu sending the request, there should be events like "step_calc" popping up, displaying the status of my action.My scriptAfter receiving the website's login cookies as a string, I am running this:const io = require('socket.io-client'); const request = require('request'); main() function main() { var socket = io(socketURL, {}); socket.on('connect', function () { setTimeout(function(){ performAction(); // Send XHR to server console.log(" > Sending XHR request...") }, 1500) }); socket.on('step_calc', function (data) { // Personal event about my action console.log(" >>> Event = step_calc: " + data) }); socket.on('login_time', function (data) { // Personal event being displayed every few seconds IF LOGGED IN (chrome) console.log(" >>> Event = step_calc: " + data) }); socket.on('userCount', function (data) { // Public event console.log(" >>> Event = userCount: " + data) }); socket.on('disconnect', function () { console.log(" > [Disconnected]"); }); } 1500ms after being connected to the socket, it would send the XHR request that should make the server emit information to the socket - performAction().When I check the chrome console:step_calc follows to a successfull XHR request (account specific)login_time is being displayed every 2 seconds, but only if i am logged in (account specific)userCount is being displayed all the time - to everybody I checked the socket.io-client's API guide and found out about socketIDs. But it only says, how to get this id after connecting to the server...http://ift.tt/2qazWDK... and yes ... when opening the website, the first thing chrome does, is send a GET request to the website, with data like this:EIO=3&transport=polling&t=1493058868222-0The response contains some kind of "sid".{"sid":"gmqoOS_________bHb","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":60000} Well...Now that I have gathered all of this information, how can I use it?How can I make the socket connection be "connected" to the cookies that I got from the login (which I am using to send requests to the website)?  Additionally:I already tried to add the same cookies as chrome uses for the handshake (the one's I get from the website login).var socket = io(socketURL, { extraHeaders: { Cookie : '...' } }); One weird thing is, that the first XHR it does when i open the website (which seems to be the handshake), already contains a cookie named "io", which is then replaced by a new one. If I check the chrome console>application>cookies, I can't see this cookie at all. Where does it come from? I can't add it to the extraHeaders.Left side: The request under the XHR tab on chrome Right side: This is being displayed under the Websocket tabhttp://i.imgur.com/VkRouQf.jpgAre those two different requests or is it the same one in some way?Does this information help somehow help to solve my problem?  I really hope that my question is kind of understandable. I had to write a bit more to make it clear. Any help is appreciated, I have already put a lot of time into trying to make it work by myself.Thanks a lot!

Submitted April 25, 2017 at 02:23PM by MrInka

No comments:

Post a Comment