tlaverdure / laravel-echo-server

Socket.io server for Laravel Echo
MIT License
2.65k stars 511 forks source link

Token mismatch #146

Closed jampack closed 7 years ago

jampack commented 7 years ago

i have <meta name="csrf-token" content="{{ csrf_token() }}"> in page header and my request is sent like:

window.Echo.private('pChat.1') .listen('newChatMessage', (data) => { console.log(data.message); });

but on laravel echo server i get Client can not be authenticated, got HTTP status 500 which in detail is like:

E:\Projects\Web\Classified Site\vendor\laravel\framework\src\Illuminate\Foundation\Http\Middleware\VerifyCsrfToken.php line 68">VerifyCsrfToken.php line 68

the user is logged in but i use user_id instead of id in my user model and database as primary key & i dont see any XSRF-token in request cookie in WS console.

jampack commented 7 years ago

by disabling csrf check it fails on

\vendor\laravel\framework\src\Illuminate\Broadcasting\Broadcasters\Redi sBroadcaster.php line 49

which is:

if (Str::startsWith($request->channel_name, ['private-', 'presence-']) && ! $request->user()) { throw new HttpException(403); }

where as i can see in the request that channel name is prefixed with 'private' as:

[2017-03-21 15:23:54] local.INFO: URL: POST /broadcasting/auth HTTP/1.1 Connection: close Content-Length: 28 Content-Type: application/x-www-form-urlencoded Cookie: io=gm_8wr56HaT5q-JNAAAM Host: classified.com X-Csrf-Token: iCrdXmvHT2stvKnubIgmOdkHO5vOqUuLmTOnjMGA X-Requested-With: XMLHttpRequest channel_name=private-pChat.1

so it has something to do with user and i believe echo cant fetch the user as the primary key is user_id not id

barryvdh commented 7 years ago

Are you sending to the same domain? Otherwise cookies might not be sent.

jampack commented 7 years ago

Sorry my mistake, instead of host: 'localhost:6001' it should be host: 'classified.com:6001' in:

window.Echo = new Echo({ broadcaster: 'socket.io', host: 'localhost:6001' });

or better dont hardcode it by setting it: window.location.hostname + ':6001'