socketio/socket.io
socketio/socket.io
Activity
Last release
Open issues
Open PRs
License
release notes
release notes
Realtime application framework (Node.JS server)
release notes
Published 1/4/2021
MinorContains breaking changesRelated blog post: https://socket.io/blog/socket-io-2-4-0/
⚠️ BREAKING CHANGE ⚠️
Previously, CORS was enabled by default, which meant that a Socket.IO server sent the necessary CORS headers (Access-Control-Allow-xxx) to any domain. This will not be the case anymore, and you now have to explicitly enable it.
Please note that you are not impacted if:
origins option to restrict the list of allowed domainsThis commit also removes the support for '*' matchers and protocol-less URL:
io.origins('https://example.com:443'); => io.origins(['https://example.com']);
io.origins('localhost:3000'); => io.origins(['http://localhost:3000']);
io.origins('http://localhost:*'); => io.origins(['http://localhost:3000']);
io.origins('*:3000'); => io.origins(['http://localhost:3000']);
To restore the previous behavior (please use with caution):
io.origins((_, callback) => {
callback(null, true);
});
See also:
Thanks a lot to @ni8walk3r for the security report.
release notes
Published 1/4/2021
MinorContains breaking changesRelated blog post: https://socket.io/blog/socket-io-2-4-0/
⚠️ BREAKING CHANGE ⚠️
Previously, CORS was enabled by default, which meant that a Socket.IO server sent the necessary CORS headers (Access-Control-Allow-xxx) to any domain. This will not be the case anymore, and you now have to explicitly enable it.
Please note that you are not impacted if:
origins option to restrict the list of allowed domainsThis commit also removes the support for '*' matchers and protocol-less URL:
io.origins('https://example.com:443'); => io.origins(['https://example.com']);
io.origins('localhost:3000'); => io.origins(['http://localhost:3000']);
io.origins('http://localhost:*'); => io.origins(['http://localhost:3000']);
io.origins('*:3000'); => io.origins(['http://localhost:3000']);
To restore the previous behavior (please use with caution):
io.origins((_, callback) => {
callback(null, true);
});
See also:
Thanks a lot to @ni8walk3r for the security report.