• #1 楼 @huacnlee 好吧,只能这样了。

  • faye 安全问题。 at 2014年07月29日

    require 'faye'

    Faye::WebSocket.load_adapter('thin') FAYE_TOKEN = 'my_token' class ServerAuth def incoming(message, callback) if message['channel'] !~ %r{^/meta/} if message['ext']['auth_token'] != FAYE_TOKEN message['error'] = 'Invalid authentication token' end end callback.call(message) end

    # IMPORTANT: clear out the auth token so it is not leaked to the client def outgoing(message, callback) if message['ext'] && message['ext']['auth_token'] message['ext'] = {}
    end callback.call(message) end end

    faye_server = Faye::RackAdapter.new(:mount => '/faye', :timeout => 45) faye_server.add_extension([ServerAuth.new,CsrfProtection.new]) run faye_server

    没有效果。。。 哪里不对??