Secure Push to AJAX Push Engine(APE)

APE (Ajax Push Engine) is an extraordinary Client/Server Framework for creating AJAX PUSH (Comet) applications. In the latest revisions on github there is even the use of HTML5´s Websockets implemented, which makes the standard way of implementing Comet by using a "hanging iframe" obsolete  (for browsers with websocket support). Also the APE server can be scripted by using JavaScript which makes it very easy to extend it´s features (at least for developers with JS knowledge). The default framework used is mootools, but any other or plain JS could do the same.

One of APE´s nice features is to invoke messages to the client by a script or application on the server side or even on a different server. This is very usefull when you want to broadcast certain server events or messages from other applications to the Clients connected to APE.

They way how to do this is is register a certain server command, which then excutes the appropriate logic. The command then can be called by the invoking script through HTTP (Depending on your needs a socket connection would also be  possible). In APE´s demo section an example for such a feature can be found in the "Controller" Demo using a simple PHP script. (If you need an OOP style Client Library to connect to APE through PHP you may want to check my APE_PHP on github) 

However in the Controller demo every message sent by the external script is broadcasted to every user connected to the certain channel. While this is usefull for a lot of cases, there might be the need to send a message to only one specific user on the channel. There is a simple solution for this problem:

One could use a different channel per user and send the message through it.  But this approach has (at least) two drawbacks. One is scalability, the other is security. Since the way this is done could be easily found out on the server side a "bad user" could connect to the other user´s channel and receive all of his private messages. This post has been inspired by a discussion on APE´s mailing list on how to implement such feature in a secure way.

In this scenario we assume that there is some kind of server side authentication process (It wouldn't make much sense otherwise anyway) . So when the user is authenticated a secret key is generated or the session key or something else is used. This key will be send to the client with the page where the APE connection will be established. 

On the server side we create a hook for the "connect" command and register the key as a private property on the user object.

1. Ape.registerHookCmd("connect", function(params, cmd) {
2.         // this makes the key a private property on the user object

3. cmd.ser.key =  params.key

4.           return 1;
5. });

Now we create our custom APE command to be called from the script:

1. Ape.registerCmd("securepush", false, function(params, infos) {

2.       if (params.password == "foobar") {     

3.                 if ($defined(params.channel) && $defined(params.key)){
4.                         var channel = Ape.getChannelByName(params.channel);
5.                         if (!$defined(channel)) return ["401", "UNKNOWN_CHANNEL"];
6.                         var sent = false;

7. channel.userslist.each(function(user){

8.                            if(user.key == params.key){
9.                               user.pipe.sendRaw(params.raw, params.data);  

10. sent = true;

11.                            }  
12.                         });            

13.                  return sent ? {"name":"pushed","data":{"value":"ok"}} : ["400", "USER_NOT_FOUND"];

14.                 }
15.                 return ["400", "BAD_KEY"];
16.         } else {
17.                 return ["400", "BAD_PASSWORD"];
18.         }
19. });

The Client then connects to APE using the special key:

1. var client = new APE.Client();

2. client.load();

3. client.addEvent('load', function() {

4.     client.core.start({"name": 'UserName', "key":"secretKey"});

5.     client.addEvent('ready', function() {

6.         client.core.join('SecureChannel');

7.     }

8. });

Now we can send a message (with the secret key)through our script to the user and only he will receive our message (Example in PHP):

1. $APEserver = 'http://ape.example.com:6969/?';
2. $APEPassword = 'foobar';
3. $cmd = array(array(
4.   'cmd' => 'securepush',
5.   'params' =>  array(
6.           'password'  => $APEPassword,
7.           'raw'       => 'postmsg',
8.           'channel'   => 'SecureChannel',
9.           'key'   => 'secretKey',
10.           'data'      => array(  
11.               'message' => 'You have a new message!'
12.           )
13.    )
14. ));
16. $res = array_pop(json_decode(file_get_contents($APEserver.rawurlencode(json_encode($cmd)))));
17. if ($res->data->value == 'ok') {
18.         echo '<br />Message sent! result: ';
19. } else {
20.         echo 'Error sending message, server response is : ';
21. }
22. echo '<pre>'.print_r($res, 1).'</pre>';
23. 
    

This is the most simple solution on how to do secure pushs to APE. However it still has (atleast) one drawback, that it uses "channel.userslist.each(function(user){[...]});" which doesn´t scale with a lot of users. I hope I will have the time to post a solution using a proper registry and a way to reconnect with usernames (the default would response with "NICK_USED" if a client would refresh the page).