title: SignalR Security
body: <p>I am new to SignalR but I was curious about how secure it is.  </p>
  
  <p>For example, I create the following method to send a message to all users like so:</p>
  
  <pre><code>public class NotificationHub : Hub
  {
      public void Send(string message)
      {
          Clients.All.broadcastMessage(message);
      }
  }
  </code></pre>
  
  <p>SignalR generates the following method in a js file (hubs):</p>
  
  <pre><code>proxies.notificationHub.server = {
      send: function (message) {
          return proxies.notificationHub.invoke.apply(proxies.notificationHub, $.merge(["Send"], $.makeArray(arguments)));
       }
  };
  </code></pre>
  
  <p>So, couldn't any user in the world just copy and paste this into their console and send a message of their choice to all of my users without my say-so?</p>
  
  <pre><code>var notifications = $.connection.notificationHub;
  notifications.server.send("Your site has been hacked!");
  </code></pre>
  
  <p>I just tried this and it works - so, how can I prevent my users from sending unauthorized messages from the client side?</p>