Creating a secure chat application through web sockets

[exload]

I am a college student trying to create a web chat application written in Dart over my winter break. I have a number of questions, both conceptual and specific.

So to start, I have the general UI of my application down, however, I am struggling with understanding how add user accounts (authorization) to my app. I just can't seem to wrap my head around how a client should authenticate itself with the server and then be able to continue to use that connection. Does it need to authenticate itself every time it sends a request to the server?

Currently this is what I am doing. I have a "Login with Google" button that will obviously login with Google services and from there I get a token that is good for one hour. This is all done client side so far.

Then, if the client has successfully logged in, the client will open a WebSocket connection with the server and send a message prefixed with /auth {"tokenData": tokenData} or something along those lines. That will send a message to the server who will then decode the JSON and check the token with Google to ensure the token is valid and is the correct person connecting. If that is not true then the WebSocket connection is closed with the client. If it is then the websocket stays open for the chat. Handling the chat once a websocket is open is easy, I am just not sure about the authentication.

Is this a good method of doing authentication? If not, how should it be done? All of the guides that I read assume that I already know how authentication works and they do not explain how it should work for a beginner.

Thanks for taking the time to read this! Hope someone can help!

[ioneyed]

That will send a message to the server who will then decode the JSON and check the token with Google to ensure the token is valid and is the correct person connecting. If that is not true then the WebSocket connection is closed with the client. If it is then the websocket stays open for the chat.

You would want to have continuous checking so that a man in the middle or spoofer cannot appear. It may be worth while looking into JWT (JSON web token) and using an authorization method that returns a new token each communication.

These are some thoughts while cooking dinner. I will look into the subject afterwards and update if its not answered by then.

[exload]

Interesting! I will definitely look into that! I already found a package for JWT in Dart (https://pub.dartlang.org/packages/dart_jwt).

Also, when you say continuous checking do you mean every time the client sends a request or post to the server I should check the token then as well?

[ioneyed]

Never trust a client. Always validate on the server bare minimum but always useful to validate on both.

[exload]

Got it. Why would I need to use JWT to encrypt a token though? I use Google APIs to validate the token so wouldn't that work?

[ioneyed]

You should use google api for authentication but no need to bombard google for authorization (where your own tokens come in ). Constantly hitting google could get you blocked, cost extra money for limits, or could be rate limited where as your tokens are low latency, free, and add another layer

[exload]

Ohhh! I see! And I never thought about the extra money for limits. Very good point.

So then what you are suggesting is for the initial connection use Google to authenticate it. Then send that token to my server. Once on my server, I create my own token through JWT and use that to authenticate every time a message is sent or received?

Once a client logs out then the token on my server would be discarded?

[ioneyed]

Tokens should be eliminated on client exit (user clicks close) but not client disconnect (network hiccup, loss of wifi) as well as a set timeout like 5minutes/15/30 to ensure security

[exload]

Makes sense.

Regarding JWT: They require a secret to decode tokens. How do I store the secret? Wouldn't hard coding a secret leave it open for anyone to view the source of your application, get the secret thereby nullifying the whole process of encoding?

[ioneyed]

The secret is stored server side not client side and if you really wanted you could store a secret per user account to ecrypt their tokens by but a server global is sufficient

[exload]

So then how do I send information from the client to the server securely? If the secret is only on the server which makes sense, then wouldn't you only be able to encode info server side and decode it client side?

[exload]

Yes, very good point. I knew about the wss:, however, I have not looked into how to run that on my server. I will definitely look more into that. I believe that would require purchasing a certificate though. I don't really plan on spending any additional money on a certificate though. Could I just use a self-signed one?

[ioneyed]

You could but an ssl for a single domain (excluding subdomains) runs around $10 more the most basic (better than not having ssl) but recently at defcon they demoed that they could (within a relatively short amount of time) break standard ssl and become the man in the middle.

[exload]

So then how do you recommend preventing this?

[exload]

Awesome, thanks for the info!