title: Socket.io, Security and Multiplayer
body: <p>I'm currently making a online game and I'm wondering about the security of Node.js and socket.io.</p>
  
  <h3>Current State of the Game</h3>
  
  <p>All my</p>
  
  <pre><code>io.sockets.on('connection', function (socket) {
      socket.on('request', function (data) {
  }) });
  </code></pre>
  
  <p>are secure. Players can emit any request (request refers to 'request' in this example) with any data (refers to 'data') and they won't be able to take avantage of it, even if they manually modify what request and data they emit and bypass client basic security. They also won't be able to make the server crash by sending invalide data. </p>
  
  <p>Note: I only have 2 emits : emitting user/pass to log in and emitting input. The server sends data via various 'emit' though. There's no 'usual' notion of session(), or GET/POST. On client side, I'm exclusively using </p>
  
  <pre><code> var socket = io.connect('http://something:3000');
   socket.emit('request', data);
  </code></pre>
  
  <hr>
  
  <p>For the static resources that players will need to get the code + images, it looks like:</p>
  
  <pre><code> app.use(express.static(__dirname + '/public'));
  </code></pre>
  
  <p>For database:</p>
  
  <pre><code> client = mysql.createConnection({  host: 'localhost',  user: 'root',   password: 'something',});
   client.connect(); client.query('USE dbname'); 
  </code></pre>
  
  <p>And finally for routing?, I show the same page, no matter the request:</p>
  
  <pre><code> app.get('/', function (req, res) { 
        res.sendfile(__dirname + '/index.html'); 
   });
  </code></pre>
  
  <hr>
  
  <h3>Concerns:</h3>
  
  <ul>
  <li>Could someone access my database by other ways than emitting an injection?</li>
  <li>Could someone modify the static resources that are loaded by everyone?</li>
  <li>Could someone have access to the whole server script or modify in a way its variables?</li>
  <li>Is there a way to limit maximum concurrent connections and maximum amount of data sent at once?</li>
  <li>Do I need any security module at all?</li>
  <li>Any other concern you think is appropriate.</li>
  </ul>
  
  <p><strong>Thanks a lot.</strong></p>