Pusher private channel authorization with Parse
//On client (browser)
Pusher.authorizers.parse = function (socketId, callback) {
var pusherData = {
socketid: socketId,
channelname: this.channel.name
};
Parse.Cloud.run('authorizePusherChannel', pusherData, {
success: function (result) {
callback(false, JSON.parse(result));
},
error: function (error) {
callback(true, error);
}
});
};
//On Parse Cloud Code
Parse.Cloud.define('authorizePusherChannel', function (request, response) {
if (!request.user) { response.error('User should be autenticated.'); }
var pusherAppKey = 'your-pusher-app-key';
var pusherAppSecret = 'your-pusher-app-secret';
var stringToSign = request.params.socketid + ':' + request.params.channelname;
var authToken = pusherAppKey + ':' + crypto.createHmac('sha256', pusherAppSecret).update(stringToSign).digest('hex');
response.success(JSON.stringify({auth:authToken}));
});
Written by Samuel Barbosa
Related protips
Have a fresh tip? Share with Coderwall community!
JavaScript on a page runs with the privileges of that origin. One altered library, tag manager, or snippet can read inputs, change what people see, and call your APIs as the user.
Security insights from Cside