Skip to content

Fix namespace reconnect state, Engine.IO transport validation, and handshake metadata#28

Open
itsfuad wants to merge 3 commits intosocketio:mainfrom
itsfuad:fix/repro-report-and-protocol-bugs
Open

Fix namespace reconnect state, Engine.IO transport validation, and handshake metadata#28
itsfuad wants to merge 3 commits intosocketio:mainfrom
itsfuad:fix/repro-report-and-protocol-bugs

Conversation

@itsfuad
Copy link
Copy Markdown
Contributor

@itsfuad itsfuad commented Mar 25, 2026

This PR fixes four confirmed protocol and metadata bugs across the Socket.IO and
Engine.IO layers:

  • removes stale namespace state after a namespace disconnect so reconnecting to
    the same namespace works on the same Engine.IO session
  • rejects transport=websocket requests for polling sessions unless the request
    is a real WebSocket upgrade
  • applies editResponseHeaders to CORS preflight responses as documented
  • derives secure and xdomain from the actual request URL and Origin header
    instead of hardcoded values

How This Solves The Issues

Namespace reconnect

Client stored namespace sockets by namespace name but removed them by socket
id. This PR makes removal use socket.nsp.name, so 41/custom, actually clears
the namespace entry and a later 40/custom, can reconnect cleanly.

Transport mismatch validation

Engine.IO now distinguishes a valid polling-to-websocket upgrade request from an
ordinary HTTP request that merely carries transport=websocket. Non-upgrade
mismatches are rejected with the existing TRANSPORT_MISMATCH error instead of
hanging on the polling transport.

Preflight response headers

editResponseHeaders now runs before the early OPTIONS return path, so custom
response headers are applied consistently to preflight and non-preflight
requests.

Handshake metadata

Handshake metadata is now derived from the request URL and Origin header:

  • secure is true for https: requests
  • xdomain is only true when Origin differs from the request origin

Tests

Added regression coverage for:

  • namespace reconnect after 41/custom,
  • polling session transport mismatch with transport=websocket
  • editResponseHeaders on OPTIONS preflight requests
  • handshake secure and xdomain metadata derivation

Full test suite result on branch fix/repro-report-and-protocol-bugs:

ok | 25 passed (176 steps) | 0 failed | 0 ignored (1 step)

Command used:

/home/fuad/.deno/bin/deno test -A

itsfuad added 3 commits March 25, 2026 19:02
Move OPTIONS response after editResponseHeaders so custom headers are
included in preflight responses. Allow websocket upgrades from polling
when an Upgrade header is present; reject other invalid transport
transitions with TRANSPORT_MISMATCH. Refactor Socket.IO client handshake
creation (createHandshakeBase), fix socket removal key, and update/add
tests accordingly.
@itsfuad
Copy link
Copy Markdown
Contributor Author

itsfuad commented Mar 25, 2026

@darrachequesne Could you kindly review please?

@itsfuad
Copy link
Copy Markdown
Contributor Author

itsfuad commented Apr 13, 2026

@darrachequesne Just a friendly ping. Didn't hear any feedback from you.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant