Can't emit to client during middleware without ending it with next

[lambertkevin]

I'm implementing a simple middleware with socket.io 3.1.1 and looking for a way to allow a request to wait for a refreshed accessToken before sending an error.

My attempts have been unsuccessful as it looks like I can't emit an event to my client (asking him to refresh its token and sending it back) without ending the middleware lifecycle with next.

Here is a simplified version of the middleware:

const middleware = (socket, next) => {
  try {
    const { token } = socket.handshake.auth;

    jwt.verify(token, process.env.SERVICE_JWT_SECRET);
    socket.handshake.decodedToken = jwt.decode(token);

    next();
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      try {
        // Ask client to refresh his token and resend it
        socket.emit('refresh-token', null, (response) => {
          jwt.verify(response, process.env.SERVICE_JWT_SECRET);
          socket.handshake.decodedToken = jwt.decode(response);

          next();
        });
      } catch {
        next(error);
      }
    }
  }
}

It looks like emitting any event to the client without using next is never sent and I would like to avoid disconnecting and reconnecting.
Is there a way to do this that I'm missing ?

[darrachequesne]

You can send the error to the client:

const middleware = (socket, next) => {
  try {
    const { token } = socket.handshake.auth;

    jwt.verify(token, process.env.SERVICE_JWT_SECRET);
    socket.handshake.decodedToken = jwt.decode(token);

    next();
  } catch (error) {
    if (error.name === 'TokenExpiredError') {
      next(new Error('TokenExpiredError'));
    } else {
      // handle other errors (but always call next)
    }
  }
}

And handle it on the client:

socket.on('connect_error', (err) => {
  if (err.name === 'TokenExpiredError') {
    // refresh token, and then try to reconnect
    socket.connect();
  }
});

Documentation: https://socket.io/docs/v3/middlewares/#Handling-middleware-error

[lambertkevin]

Ok it looks like a misunderstanding on my part as to when the middleware was reached. The middleware is going to get called only on client connection and not on all the events emitted and listened by the authorized client.

Which (if I'm correct above) would mean that, hypothetically, a client connected with a valid JWT would never need to refresh its token as long as it doesn't disconnect. Am i correct ?

Also, is this an acceptable behavior for security ? As of right now, it still feels weird in my head to be able to completely ignore a JWT expiration...

Thanks a lot for your help !