Research
Security News
Malicious npm Packages Inject SSH Backdoors via Typosquatted Libraries
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
y-websocket
Advanced tools
WebSocket Provider for Yjs
The Websocket Provider implements a classical client server model. Clients connect to a single endpoint over Websocket. The server distributes awareness information and document updates among clients.
This repository contains a simple in-memory backend that can persist to databases, but it can't be scaled easily. The y-redis repository contains an alternative backend that is scalable, provides auth*, and can persist to different backends.
The Websocket Provider is a solid choice if you want a central source that handles authentication and authorization. Websockets also send header information and cookies, so you can use existing authentication mechanisms with this server.
npm i y-websocket
This repository implements a basic server that you can adopt to your specific use-case. (source code)
Start a y-websocket server:
HOST=localhost PORT=1234 npx y-websocket
import * as Y from 'yjs'
import { WebsocketProvider } from 'y-websocket'
const doc = new Y.Doc()
const wsProvider = new WebsocketProvider('ws://localhost:1234', 'my-roomname', doc)
wsProvider.on('status', event => {
console.log(event.status) // logs "connected" or "disconnected"
})
The WebSocket provider requires a WebSocket
object to create connection to a server. You can polyfill WebSocket support in Node.js using the ws
package.
const wsProvider = new WebsocketProvider('ws://localhost:1234', 'my-roomname', doc, { WebSocketPolyfill: require('ws') })
import { WebsocketProvider } from 'y-websocket'
wsProvider = new WebsocketProvider(serverUrl: string, room: string, ydoc: Y.Doc [, wsOpts: WsOpts])
wsOpts = {
// Set this to `false` if you want to connect manually using wsProvider.connect()
connect: true,
// Specify a query-string / url parameters that will be url-encoded and attached to the `serverUrl`
// I.e. params = { auth: "bearer" } will be transformed to "?auth=bearer"
params: {}, // Object<string,string>
// You may polyill the Websocket object (https://developer.mozilla.org/en-US/docs/Web/API/WebSocket).
// E.g. In nodejs, you could specify WebsocketPolyfill = require('ws')
WebsocketPolyfill: Websocket,
// Specify an existing Awareness instance - see https://github.com/yjs/y-protocols
awareness: new awarenessProtocol.Awareness(ydoc),
// Specify the maximum amount to wait between reconnects (we use exponential backoff).
maxBackoffTime: 2500
}
wsProvider.wsconnected: boolean
wsProvider.wsconnecting: boolean
wsProvider.shouldConnect: boolean
wsProvider.bcconnected: boolean
wsProvider.synced: boolean
wsProvider.params : boolean
wsProvider.disconnect()
wsProvider.connect()
wsProvider.destroy()
wsProvider.on('sync', function(isSynced: boolean))
wsProvider.on('status', function({ status: 'disconnected' | 'connecting' | 'connected' }))
wsProvider.on('connection-close', function(WSClosedEvent))
wsProvider.on('connection-error', function(WSErrorEvent))
Start a y-websocket server:
HOST=localhost PORT=1234 npx y-websocket
Since npm symlinks the y-websocket
executable from your local ./node_modules/.bin
folder, you can simply run npx. The PORT
environment variable already defaults to 1234, and HOST
defaults to localhost
.
Persist document updates in a LevelDB database.
See LevelDB Persistence for more info.
HOST=localhost PORT=1234 YPERSISTENCE=./dbDir node ./node_modules/y-websocket/bin/server.js
Send a debounced callback to an HTTP server (POST
) on document update. Note that this implementation doesn't implement a retry logic in case the CALLBACK_URL
does not work.
Can take the following ENV variables:
CALLBACK_URL
: Callback server URLCALLBACK_DEBOUNCE_WAIT
: Debounce time between callbacks (in ms). Defaults to 2000 msCALLBACK_DEBOUNCE_MAXWAIT
: Maximum time to wait before callback. Defaults to 10 secondsCALLBACK_TIMEOUT
: Timeout for the HTTP call. Defaults to 5 secondsCALLBACK_OBJECTS
: JSON of shared objects to get data ('{"SHARED_OBJECT_NAME":"SHARED_OBJECT_TYPE}'
)CALLBACK_URL=http://localhost:3000/ CALLBACK_OBJECTS='{"prosemirror":"XmlFragment"}' npm start
This sends a debounced callback to localhost:3000
2 seconds after receiving an update (default DEBOUNCE_WAIT
) with the data of an XmlFragment named "prosemirror"
in the body.
The MIT License © Kevin Jahns
FAQs
Websockets provider for Yjs
The npm package y-websocket receives a total of 73,137 weekly downloads. As such, y-websocket popularity was classified as popular.
We found that y-websocket demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 1 open source maintainer collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Research
Security News
Socket’s threat research team has detected six malicious npm packages typosquatting popular libraries to insert SSH backdoors.
Security News
MITRE's 2024 CWE Top 25 highlights critical software vulnerabilities like XSS, SQL Injection, and CSRF, reflecting shifts due to a refined ranking methodology.
Security News
In this segment of the Risky Business podcast, Feross Aboukhadijeh and Patrick Gray discuss the challenges of tracking malware discovered in open source softare.