wip

src/LaravelEcho/Pusher/Channels/Channel.php

@@ -2,8 +2,10 @@
 
 namespace BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Channels;
 
+use BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Exceptions\InvalidSignatureException;
 use Illuminate\Support\Collection;
 use Ratchet\ConnectionInterface;
+use stdClass;
 
 class Channel
 {
@@ -23,10 +25,26 @@ class Channel
         return count($this->connections) > 0;
     }
 
+    protected function verifySignature(ConnectionInterface $connection, stdClass $payload)
+    {
+        $auth = $payload->auth;
+
+        $signature = "{$connection->socketId}:{$this->channelId}";
+
+        if (isset($payload->channel_data)) {
+            $signature .= ":{$payload->channel_data}";
+        }
+
+        // TODO Have app id specific secrets
+        if (str_after($auth, ':') !== hash_hmac('sha256', $signature, config('broadcasting.connections.pusher.secret'))) {
+            throw new InvalidSignatureException();
+        }
+    }
+
     /*
      * @link https://pusher.com/docs/pusher_protocol#presence-channel-events
      */
-    public function subscribe(ConnectionInterface $connection, $payload)
+    public function subscribe(ConnectionInterface $connection, stdClass $payload)
     {
         $this->saveConnection($connection);
 

src/LaravelEcho/Pusher/Channels/PresenceChannel.php

@@ -13,6 +13,8 @@ class PresenceChannel extends Channel
      */
     public function subscribe(ConnectionInterface $connection, $payload)
     {
+        $this->verifySignature($connection, $payload);
+
         $this->saveConnection($connection);
 
         $channelData = json_decode($payload->channel_data);

src/LaravelEcho/Pusher/Channels/PrivateChannel.php

@@ -2,7 +2,15 @@
 
 namespace BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Channels;
 
+use Ratchet\ConnectionInterface;
+use stdClass;
+
 class PrivateChannel extends Channel
 {
+    public function subscribe(ConnectionInterface $connection, stdClass $payload)
+    {
+        $this->verifySignature($connection, $payload);
 
+        parent::subscribe($connection, $payload);
+    }
 }

src/LaravelEcho/Pusher/Exceptions/InvalidSignatureException.php

@@ -0,0 +1,12 @@
+<?php
+
+namespace BeyondCode\LaravelWebSockets\LaravelEcho\Pusher\Exceptions;
+
+class InvalidSignatureException extends PusherException
+{
+    public function __construct()
+    {
+        $this->message = 'Invalid Signature';
+        $this->code = 4009;
+    }
+}

src/LaravelEcho/Pusher/Exceptions/PusherException.php

@@ -0,0 +1,20 @@
+<?php
+
+namespace BeyondCode\LaravelWebsockets\LaravelEcho\Pusher\Exceptions;
+
+use Exception;
+
+class PusherException extends Exception
+{
+
+    public function getPayload()
+    {
+        return [
+            'event' => 'pusher:error',
+            'data' => [
+                'message' => $this->getMessage(),
+                'code' => $this->getCode()
+            ]
+        ];
+    }
+}

src/LaravelEcho/WebSocket/EchoServer.php

@@ -2,6 +2,8 @@
 
 namespace BeyondCode\LaravelWebSockets\LaravelEcho\WebSocket;
 
+use BeyondCode\LaravelWebsockets\LaravelEcho\Pusher\Exceptions\PusherException;
+use Exception;
 use Ratchet\ConnectionInterface;
 use Ratchet\RFC6455\Messaging\MessageInterface;
 use BeyondCode\LaravelWebSockets\WebSocketController;
@@ -57,4 +59,13 @@ class EchoServer extends WebSocketController
     {
         $this->channelManager->removeFromAllChannels($connection);
     }
+
+    function onError(ConnectionInterface $connection, Exception $exception)
+    {
+        if ($exception instanceof PusherException) {
+            $connection->send(json_encode(
+                $exception->getPayload()
+            ));
+        }
+    }
 }