
Research
Security News
The Landscape of Malicious Open Source Packages: 2025 Mid‑Year Threat Report
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
github.com/socketio/socket.io-redis
socket.io-redis
Installation:
$ npm install @socket.io/redis-adapter redis
const { Server } = require('socket.io');
const { createClient } = require('redis');
const { createAdapter } = require('@socket.io/redis-adapter');
const io = new Server();
const pubClient = createClient({ host: 'localhost', port: 6379 });
const subClient = pubClient.duplicate();
Promise.all([pubClient.connect(), subClient.connect()]).then(() => {
io.adapter(createAdapter(pubClient, subClient));
io.listen(3000);
});
With redis@3
, calling connect()
on the Redis clients is not needed:
const { Server } = require('socket.io');
const { createClient } = require('redis');
const { createAdapter } = require('@socket.io/redis-adapter');
const io = new Server();
const pubClient = createClient({ host: 'localhost', port: 6379 });
const subClient = pubClient.duplicate();
io.adapter(createAdapter(pubClient, subClient));
io.listen(3000);
import { Server } from 'socket.io';
import { createClient } from 'redis';
import { createAdapter } from '@socket.io/redis-adapter';
const io = new Server();
const pubClient = createClient({ host: 'localhost', port: 6379 });
const subClient = pubClient.duplicate();
Promise.all([pubClient.connect(), subClient.connect()]).then(() => {
io.adapter(createAdapter(pubClient, subClient));
io.listen(3000);
});
import { Server } from 'socket.io';
import { createClient } from 'redis';
import { createAdapter } from '@socket.io/redis-adapter';
const io = new Server();
const pubClient = createClient({ host: 'localhost', port: 6379 });
const subClient = pubClient.duplicate();
Promise.all([pubClient.connect(), subClient.connect()]).then(() => {
io.adapter(createAdapter(pubClient, subClient));
io.listen(3000);
});
By running Socket.IO with the @socket.io/redis-adapter
adapter you can run
multiple Socket.IO instances in different processes or servers that can
all broadcast and emit events to and from each other.
So any of the following commands:
io.emit('hello', 'to all clients');
io.to('room42').emit('hello', "to all clients in 'room42' room");
io.on('connection', (socket) => {
socket.broadcast.emit('hello', 'to all clients except sender');
socket.to('room42').emit('hello', "to all clients in 'room42' room except sender");
});
will properly be broadcast to the clients through the Redis Pub/Sub mechanism.
If you need to emit events to socket.io instances from a non-socket.io process, you should use socket.io-emitter.
Sharded Pub/Sub was introduced in Redis 7.0 in order to help scaling the usage of Pub/Sub in cluster mode.
Reference: https://redis.io/docs/manual/pubsub/#sharded-pubsub
A dedicated adapter can be created with the createShardedAdapter()
method:
import { Server } from 'socket.io';
import { createClient } from 'redis';
import { createShardedAdapter } from '@socket.io/redis-adapter';
const pubClient = createClient({ host: 'localhost', port: 6379 });
const subClient = pubClient.duplicate();
await Promise.all([
pubClient.connect(),
subClient.connect()
]);
const io = new Server({
adapter: createShardedAdapter(pubClient, subClient)
});
io.listen(3000);
Minimum requirements:
redis@4.6.0
Redis Adapter version | Socket.IO server version |
---|---|
4.x | 1.x |
5.x | 2.x |
6.0.x | 3.x |
6.1.x and above | 4.x |
This adapter extends the in-memory adapter that is included by default with the Socket.IO server.
The in-memory adapter stores the relationships between Sockets and Rooms in two Maps.
When you run socket.join("room21")
, here's what happens:
console.log(adapter.rooms); // Map { "room21" => Set { "mdpk4kxF5CmhwfCdAHD8" } }
console.log(adapter.sids); // Map { "mdpk4kxF5CmhwfCdAHD8" => Set { "mdpk4kxF5CmhwfCdAHD8", "room21" } }
// "mdpk4kxF5CmhwfCdAHD8" being the ID of the given socket
Those two Maps are then used when broadcasting:
io.emit()
) loops through the sids
Map, and send the packet to all socketsio.to("room21").emit()
) loops through the Set in the rooms
Map, and sends the packet to all matching socketsThe Redis adapter extends the broadcast function of the in-memory adapter: the packet is also published to a Redis channel (see below for the format of the channel name).
Each Socket.IO server receives this packet and broadcasts it to its own list of connected sockets.
To check what's happening on your Redis instance:
$ redis-cli
127.0.0.1:6379> PSUBSCRIBE *
Reading messages... (press Ctrl-C to quit)
1) "psubscribe"
2) "*"
3) (integer) 1
1) "pmessage"
2) "*"
3) "socket.io#/#" (a broadcast to all sockets or to a list of rooms)
4) <the packet content>
1) "pmessage"
2) "*"
3) "socket.io#/#room21#" (a broadcast to a single room)
4) <the packet content>
Note: no data is stored in Redis itself
There are 3 Redis subscriptions per namespace:
<prefix>#<namespace>#*
(glob)<prefix>-request#<namespace>#
<prefix>-response#<namespace>#
The request and response channels are used in the additional methods exposed by the Redis adapter, like RedisAdapter#allRooms().
The following options are allowed:
key
: the name of the key to pub/sub events on as prefix (socket.io
)requestsTimeout
: optional, after this timeout the adapter will stop waiting from responses to request (5000ms
)parser
: optional, parser to use for encoding and decoding messages passed through Redis (notepack.io
)The redis adapter instances expose the following properties
that a regular Adapter
does not
uid
prefix
pubClient
subClient
requestsTimeout
parser
Returns the list of all rooms.
const rooms = await io.of('/').adapter.allRooms();
console.log(rooms); // a Set containing all rooms (across every node)
const io = require('socket.io')(3000);
const redisAdapter = require('@socket.io/redis-adapter');
const Redis = require('ioredis');
const startupNodes = [
{
port: 6380,
host: '127.0.0.1'
},
{
port: 6381,
host: '127.0.0.1'
}
];
const pubClient = new Redis.Cluster(startupNodes);
const subClient = pubClient.duplicate();
io.adapter(redisAdapter(pubClient, subClient));
const io = require('socket.io')(3000);
const redisAdapter = require('@socket.io/redis-adapter');
const Redis = require('ioredis');
const options = {
sentinels: [
{ host: 'somehost1', port: 26379 },
{ host: 'somehost2', port: 26379 }
],
name: 'master01'
};
const pubClient = new Redis(options);
const subClient = pubClient.duplicate();
io.adapter(redisAdapter(pubClient, subClient));
The @socket.io/redis-adapter
adapter broadcasts and receives messages on particularly named Redis channels. For global broadcasts the channel name is:
prefix + '#' + namespace + '#'
In broadcasting to a single room the channel name is:
prefix + '#' + namespace + '#' + room + '#'
prefix
: The base channel name. Default value is socket.io
. Changed by setting opts.key
in adapter(opts)
constructornamespace
: See https://github.com/socketio/socket.io#namespace.room
: Used if targeting a specific room.A number of other libraries adopt this protocol including:
socket.io-redis
The package was renamed from socket.io-redis
to @socket.io/redis-adapter
in v7, in order to match the name of the Redis emitter (@socket.io/redis-emitter
).
To migrate to the new package, you'll need to make sure to provide your own Redis clients, as the package will no longer create Redis clients on behalf of the user.
Before:
const redisAdapter = require("socket.io-redis");
io.adapter(redisAdapter({ host: "localhost", port: 6379 }));
After:
const { createClient } = require("redis");
const { createAdapter } = require("@socket.io/redis-adapter");
const pubClient = createClient({ host: "localhost", port: 6379 });
const subClient = pubClient.duplicate();
io.adapter(createAdapter(pubClient, subClient));
Please note that the communication protocol between the Socket.IO servers has not been updated, so you can have some servers with socket.io-redis
and some others with @socket.io/redis-adapter
at the same time.
MIT
FAQs
Unknown package
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
A look at the top trends in how threat actors are weaponizing open source packages to deliver malware and persist across the software supply chain.
Security News
ESLint now supports HTML linting with 48 new rules, expanding its language plugin system to cover more of the modern web development stack.
Security News
CISA is discontinuing official RSS support for KEV and cybersecurity alerts, shifting updates to email and social media, disrupting automation workflows.