
Security News
Attackers Are Hunting High-Impact Node.js Maintainers in a Coordinated Social Engineering Campaign
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.
firesocket
Advanced tools
A drop-in replacement for WebSocket using Firebase Realtime Database.
An example showing dynamically switching between FireSocket and WebSocket is in example/.
A full example is running at https://firesocketexample.appspot.com/.
server:
const express = require("express");
const ws = require("ws");
const app = express();
const wss = new ws.Server({server});
wss.on("connection", ws => ...
client:
const ws = new WebSocket(window.location.href.replace("http", "ws"));
ws.addEventListener("open", () => ...
server:
const firesocket = require("firesocket");
const express = require("express");
const app = express();
const wss = firesocket.Server.createFromCreds(databaseUrl, {app, firebaseConfig});
wss.on("connection", ws => ...
client:
const ws = new FireSocket(); // Args are ignored
ws.addEventListener("open", () => ...
npm install firesocketfirebase clifirebase loginfirebase init
node_modules/firesocket/database.rules.jsonfirebase deploy --only databaseroles/firebasedatabase.admingcloud iam service-accounts keys create .test-creds.json --iam-account example@example.com$env:GOOGLE_APPLICATION_CREDENTIALS=".test-creds.json"WebSocket to FireSocket
require("firesocket")firesocket.Server.createFromCreds factory to create Server.FireSocket.Server object is API-compatible with WebSocket.Server/firebase-config.jsonfiresocket.Server helper will add this to your express server/firesocket.js before your web app's logic
WebSocket with FireSocket (constructor args are ignored)FireSocket object is API-compatible with WebSocketfiresocket.Server helper will serve this scriptRun npm test to run all tests. This includes unit tests, and mock tests using the firebase emulator and a local WebSocket server. See spec/ for more information.
The example/ can be useful for manually debugging changes.
The default client-server communication, and by far the fastest. It's pretty simple for a web game to just update state and issue questions based on player events.
Downsides:
Using Firebase Realtime Database, it is possible to emulate WebSocket messages.
This fixes both limitations:
Realtime Database was picked over Firestore because the average round trip latency of 600ms is fast enough to barely be noticed by users, while Firestore is noticeably slower at 1500ms. medium.com
Guide: Info on Data Model, Auth, Queues
Each game is composed of messages from server to client, and v/v.
Each firebase client listens for child_added on their message queue.
Here, user* is a userID from Firebase Authentication
user:
userWQ3mVT:
0: Message: Connected to Game
1: Choice: New Game, Refresh
2: Message: Cards
3: Choice: Play Copper, Buy Copper
user7f8pR:
0: Message: Connected to Game
1: Choice: New Game, Refresh, alice's game
server:
userWQ3mVT:
0: Name: alice
1: Choice: New Game
2: Start: Militia, Moat, ...
user7f8pR:
0: Name: bob
1: Choice: Refresh
FAQs
A drop-in replacement for WebSocket using Firebase Realtime Database
The npm package firesocket receives a total of 11 weekly downloads. As such, firesocket popularity was classified as not popular.
We found that firesocket demonstrated a not healthy version release cadence and project activity because the last version was released a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?

Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.

Security News
Multiple high-impact npm maintainers confirm they have been targeted in the same social engineering campaign that compromised Axios.

Security News
Axios compromise traced to social engineering, showing how attacks on maintainers can bypass controls and expose the broader software supply chain.

Security News
Node.js has paused its bug bounty program after funding ended, removing payouts for vulnerability reports but keeping its security process unchanged.