How to protect Socket.io from client injection?

Question

Socket.io

How to make sure that the client cannot call and edit anything through a simple browser console, and protect it from connecting from other sites?

Answer 1

No way. But you can change the subscription data, for example, if you have a channel:
App.User.{userId}
Instead of a user ID, use some hash that will change every few hours. Thus, it is impossible to avoid unauthorized connection to the room, but this will somewhat complicate the process of random connection to rooms.

Answer 2

Nothing, everything that a browser can do, the client can do, pretending to be a browser

Answer 3

To protect against connections from other sites, check the Origin header. Of course it can be faked. But regular browsers don't allow modifying this header from JavaScript