title: WAMP.ws : How to manage security and privacy?
body: <p>I'm using WAMP.ws specifications to design public/private user chatrooms on my website.</p>
  
  <p>My problem comes when I try to keep a list of all connected users.
  What I could do :</p>
  
  <ol>
  <li>All users subscribe to "/contacts/connections" topic.</li>
  <li>When an user connects he publishes a "hello" message with a "user_id" argument, telling other users that he is connected.</li>
  </ol>
  
  <p>--> But how can I trust users ? Any user could send an "Hello" message with a random "user_id" argument.</p>
  
  <p>To me, the server have to do some checks before broadcasting the message. But is it in accordance with WAMP.js specifications ? I've read that a published message is always broadcasted by server.</p>
  
  <p>Another solution could be using an RPC call to connect an user. Actually, I did that for authenticating users. But can the server broadcast an Event to topic "/contacts/connections" by itself ? (after a RPC call, not after "Publish" message)
  I've read that Event are only the direct result of a "Publish" from client.
  Moreover, this would not prevent regular users to send event trought "/contacts/connections" topic, which will be broadcasted by the server.</p>
  
  <p>I feel that my two solutions (checking published messages before broadcasting, or broadcast of an event by server after an RPC call) both break WAMP.js specifications.
  Am I wrong ?</p>
  
  <p>Thank you</p>