Socket.io authenticating as a client

I made a nodeJS script to automate a few actions on a website - which is not mine!

To have a bit more control over what is going on, I would like to listen to the events on the website's socket.io stream.

Works in NODE so far:

• Logging into the website and receiving their cookies as a string for further requests
• Sending requests with the cookies from the login (do the actual actions)
• Open a websocket connection and listen to the public (!) events

Doesn't work in NODE yet:

• Read "private" events that are only being sent to a specific user (me)

I inspected a XHR request that is happening in chrome when clicking a specific button on this website. After this request has been sent, the websocket connection on chrome emits events about the status of my action. Of course, these events are only being sent to the user who performed this action.

Doing the exact same request in node (with the cookies from the website login) gives the right response (success), but the socket stream i opened before, only shows some public events - nothing about my actions.

As seen here, it logs in, displays the website's cookies, opens a socket stream. Then it sends a XHR POST request with the displayed cookies in the headers. The response says "success", but the socket.io events popping up once a second are only the public ones (userCount).

http://i.imgur.com/ZUrA2el.jpg

After sending the request, there should be events like "step_calc" popping up, displaying the status of my action.

My script

After receiving the website's login cookies as a string, I am running this:

const io = require('socket.io-client');
const request = require('request');

main()

function main() {

            var socket = io(socketURL, {});

            socket.on('connect', function () {
                setTimeout(function(){
                    performAction();                                // Send XHR to server
                    console.log(" > Sending XHR request...")
                }, 1500)
            });

            socket.on('step_calc', function (data) {               // Personal event about my action
                console.log(" >>> Event = step_calc: " + data)
            });

            socket.on('login_time', function (data) {               // Personal event being displayed every few seconds IF LOGGED IN (chrome)                    console.log(" >>> Event = step_calc: " + data)
            });

            socket.on('userCount', function (data) {                // Public event
                console.log(" >>> Event = userCount: " + data)
            });

            socket.on('disconnect', function () {
                console.log(" > [Disconnected]");
            });
}

1500ms after being connected to the socket, it would send the XHR request that should make the server emit information to the socket - performAction().

When I check the chrome console:

• step_calc follows to a successfull XHR request (account specific)

• login_time is being displayed every 2 seconds, but only if i am logged in (account specific)

• userCount is being displayed all the time - to everybody

 

I checked the socket.io-client's API guide and found out about socketIDs. But it only says, how to get this id after connecting to the server...

https://github.com/socketio/socket.io-client/blob/master/docs/API.md#socket

... and yes ... when opening the website, the first thing chrome does, is send a GET request to the website, with data like this:

EIO=3&transport=polling&t=1493058868222-0

The response contains some kind of "sid".

{"sid":"g_mqoOS__________bHb","upgrades":["websocket"],"pingInterval":25000,"pingTimeout":60000}

 

Well...

• Now that I have gathered all of this information, how can I use it?

• How can I make the socket connection be "connected" to the cookies that I got from the login (which I am using to send requests to the website)?

 

I really hope that my question is kind of understandable. Any help is appreciated, I have already put a lot of time into trying to make it work by myself.

Thanks a lot!

via Thomas Weiss