3 ms·

By using browser storage instead of hijackable session cookies, CSRF attacks are impossible. Cool, but it makes way harder to scale up without websockets sup

*By using browser storage instead of hijackable session cookies, CSRF attacks are impossible.* Cool, but it makes way harder to scale up without websockets support for load balancing, since it uses SockJS, which requires sticky sessions.

swartkrans 12y ago
It's totally possible to load balance websockets. You turn the web sockets into a dumb proxy that talks to your service. You could have a bunch of SockJS servers, with people connecting to different ones communicate with each other over the actual service. If you were building chat rooms you could assign rooms to specific servers, or you could tailor your service such that it works across a distributed system.
- STRML 12y ago
  We do something similar on BitMEX with SockJS. As long as you're not using AWS's ELB, load-balancing websockets is as easy as anything else. We use HAProxy to proxy the websocket connections as TCP, and round-robin the connections. If a server drops out, the websocket connection is disconnected and a reconnection occurs to an available server.
- jkarneges 12y ago
  I think he means that if you're using a browser that doesn't support WebSockets, then SockJS's HTTP-based fallbacks will require sticky routing. If the browser does support WebSockets, then this is not a concern.
  - swartkrans 12y ago
    I give 0 fucks about browsers that don't support web sockets.
- andremendes 12y ago
  It's possible but what I meant (and failed to make clear) is that we can't actually avoid using cookies and scale up, since websockets connections aren't widely allowed on devices, calling for SockJS use and therefore, cookies adoption.
  - deleted 12y ago
    [deleted]
  - swartkrans 12y ago
    > websockets connections aren't widely allowed on devices Like what devices don't allow websockets? Android chrome, Mobile Safari and Desktop Chrome and Firefox do and that's like almost everyone right there.
    - andremendes 12y ago
      They aren't the ones who block it. Instead it's the infrastructure providers who do it. Cloudfare started supporting it only a few months ago. Many ISP's use proxies that disallows websockets connections. Again, the point is: You can't claim you won't need cookies if you want to consider scaling up.

*By using browser storage instead of hijackable session cookies, CSRF attacks are impossible.* Cool, but it makes way harder to scale up without websockets sup

swartkrans 12y ago

It's totally possible to load balance websockets. You turn the web sockets into a dumb proxy that talks to your service. You could have a bunch of SockJS servers, with people connecting to different ones communicate with each other over the actual service. If you were building chat rooms you could assign rooms to specific servers, or you could tailor your service such that it works across a distributed system.

STRML 12y ago
We do something similar on BitMEX with SockJS. As long as you're not using AWS's ELB, load-balancing websockets is as easy as anything else. We use HAProxy to proxy the websocket connections as TCP, and round-robin the connections. If a server drops out, the websocket connection is disconnected and a reconnection occurs to an available server.
jkarneges 12y ago
I think he means that if you're using a browser that doesn't support WebSockets, then SockJS's HTTP-based fallbacks will require sticky routing. If the browser does support WebSockets, then this is not a concern.
- swartkrans 12y ago
  I give 0 fucks about browsers that don't support web sockets.
andremendes 12y ago
It's possible but what I meant (and failed to make clear) is that we can't actually avoid using cookies and scale up, since websockets connections aren't widely allowed on devices, calling for SockJS use and therefore, cookies adoption.
- deleted 12y ago
  [deleted]
- swartkrans 12y ago
  > websockets connections aren't widely allowed on devices Like what devices don't allow websockets? Android chrome, Mobile Safari and Desktop Chrome and Firefox do and that's like almost everyone right there.
  - andremendes 12y ago
    They aren't the ones who block it. Instead it's the infrastructure providers who do it. Cloudfare started supporting it only a few months ago. Many ISP's use proxies that disallows websockets connections. Again, the point is: You can't claim you won't need cookies if you want to consider scaling up.