Websockets control user access

Question

I am currently using Websockets within my php project [Ratchet, Symfony]. When a user gets logged in, he automatically gets connected to a channel within the websocket connection. I am able to push messages to the channel and to receive + display them on the client. So managing access to the websocket when connecting to it after login is no problem. Assuming we have the following case, I get a problem when it comes to authentication:

1. User is logged in and has access to a channel
2. User logs out on another tab or clears its cache
3. Until the user reloads his page, he still gets the messasges of the websocket channel.

I checked that the user , when using websockets and not ajax, is still logged in on the websocket side symfony session. When I check the same using an ajax demo -request, the user is not logged in anymore. This is the main problem, the websocket session is not synchronized with the symfony session well, because in the symfony session, the user is logged out but on the Websocket , he is still logged in.

Initially, I tried the following to avoid the described scenario above:

1. When a user gets a new message through the websocket channel, I first check by using a remote call procedure if the user is still logged in by sending a flag true or false from server (Thats where the problem with the unsynchronized session occurs)
2. When the flag is false, I unsubscribe the user from the channel
3. When the flag is true, I process the callback of the websocket channel.

In general, I think this approach would be fine (?) , but the problem I see is the unsychronized session. How to synchronize it or force the websocket channel to check for the cookie / send it again when a push reaches it? How do you handle this kind of situation?

Answer 1

How I personnaly solved this issue. I saved each connectionId I have while it was open in my database.

Then I checked which connections should receive for what channel and only sent a message to those that should receive it.

Afterwards once your problem comes up: a user logs out, then I remove the user from the database with open connections and each new message to those channels will not be sent to the user anymore.

EDIT: To solve the problem proposed here: a user refreshes his/her cache/cookies, but the connection is still open, how can I be ensured that the connection is still safe?

Answer: If a user refreshes his/her cache the socketconnection would stay in existance, although the user would close it once the browser is refreshed/redirected. The safety problem here is inexistant since the user was connected in a right way in the beginning of the session, and then cleared their cache, so that they are logged out.

If the user has bad intentions, then the connection should have never been established in the first place.