The node.js auth token that the node.js module uses to authenticate node.js is an MD5 of the user's session string. This is then queried in the database directly in the sessions table. Though few sites swap out the session handler I think we should consider adding support for pluggable session storage.

We could either change the way we do this generally or because this is probably an edge case allow this system to be in some way pluggable.

Comments

Anonymous’s picture

Anonymous (not verified) commented

mkay. for a second i thought you meant on the node.js side. something like this:

/**
 * Default Node.js auth check callback implementation.
 */
function nodejs_auth_check_callback($auth_token) {
  return db_query("SELECT uid FROM {sessions} WHERE MD5(sid) = :auth_key", array(':auth_key' => $auth_token))->fetchField();
} 

/**
 * Checks the given key to see if it matches a valid session.
 */
function nodejs_auth_check($message) {
  $nodejs_auth_check_callback = variable_get('nodejs_auth_check_callback', 'nodejs_auth_check_callback');
  if (function_exists($nodejs_auth_check_callback)) {
    return FALSE;
  } 
  $uid = $nodejs_auth_check_callback($message['authToken']);

  ...
}

/**
 * Get an auth token for the current user.
 */
function nodejs_auth_get_token() {
  $nodejs_auth_get_token_callback = variable_get('nodejs_auth_get_token_callback', 'nodejs_auth_get_token_callback');
  if (!function_exists($nodejs_auth_get_token_callback)) {
    throw new Exception("Cannot proceed without a valid nodejs_auth_get_token_callback().");
  } 
  return $nodejs_auth_get_token_callback();
} 

/**
 * Default nodejs_auth_get_token() implementation.
 */
function nodejs_auth_get_token_callback() {
  return md5(session_id());
}

update: added the get part as well.

Anonymous’s picture

Anonymous (not verified) commented
Status: Active » Fixed

committed here:

http://drupalcode.org/project/nodejs.git/commit/e4036bf

Status: Fixed » Closed (fixed)

Automatically closed -- issue fixed for 2 weeks with no activity.

  • Commit e4036bf on 7.x-1.x, auth-refactor, 8.x-1.x, 8.x-1.x-head: 
    #1698162: allow for non-default storage or node.js auth tokens, thanks...