don't use the referrer header to decide which stream to track against

[hayksaakian]

https://github.com/ILiedAboutCake/OverRustle-API/blob/master/index.js#L147

is the culprit

because headers cannot be set on websockets according to

https://github.com/Automattic/socket.io-client/issues/648#issuecomment-42154344

even though it's possible from this client https://github.com/nkzawa/socket.io-client.java/issues/32

it will probably be a breaking change.

i'm thinking we move most of the code that happens right after you connect into a separate event which explicitly sends the URL to track against.

the main reason we didn't do this before was because it opened the door to malicious clients who wanted to "view bot" their stream.

nowadays, we can continue to do the IP based flood detection while also listening for an explicit "watch" (which would specify which URL the client wants to track)

this will be a breaking change for every client connecting to the API via websockets

[hayksaakian]

idea

client:

var othersocket = null;
socket.emit("watch", {path: referrer});
socket.on("connect_to", function(data){        
    othersocket = io('http://api.overrustle.com/'+data.parsed_name, {
        reconnectionDelay: 500+(5000*Math.random())
    });
    setupCallbacks(othersocket);
}

server:

inside of handleSocket for watchers

socket.on("watch", function(data){
    parsed_name = ...
    rooms[data['path']] = io.of(parsed_name);
    socket.emit('connect_to', {parsed_name: parsed_name})
})

basically you use a one time socket to tell the server to create the room, the server notifies you once the room is ready then you use another socket to actually connect to that room

[hayksaakian]

fixed with something similar:

we're just using socket.io rooms now