search

sagarankoliya / realtime-private-chat-nodejs-socketio-vuejs-laravel

Realtime Private Chat NodeJS SocketIO Vue JS Laravel
82 stars 34 forks source link

Wrong way to put auth::id() in the meta tag #1

Closed alquhait closed 6 years ago

alquhait commented 6 years ago

Malicious users can change the content of the meta tag user_id to send message from any other users. So you may change the way user_id and it should be inside server not from client.

sagarankoliya commented 6 years ago

Message send by socket id instead of user_id, it just for demo so that`s way i have set user id in meta.