Knowing the roomId Was Enough to List and Delete Files: Adding HMAC Room Tokens to a Socket.IO App
I'm building a no-login online clipboard: devices on the same network land in the same room, and files shared there go through Cloudflare R2. This post is about locking the room's file API, which turned out to rest on a bad assumption. You can try the app here: https://www.clipboardapp.org The problem The file endpoints looked like /api/r2/files/:roomId . Send a roomId, get the file list. Send a…
The recent update to the no-login online clipboard app required a room token for listing, uploading, or deleting files using only the roomId. This change was implemented because the roomId was being used as a secret, even though it was part of the public file URL. The token was signed by the server and required to prove that the user was legitimately in the room.
The token itself was not included in any URLs and had a default lifetime of two hours. It was issued upon the client's socket connection and only for the room the server had already allocated to that socket. The token was stored in the frontend's memory, and it expired after the specified time. The backend middleware enforced the token requirement, with a mechanism to switch to a "report-only" mode for testing purposes.
Despite these improvements, the token could theoretically be leaked and used until its expiration, and there was no revocation mechanism in place. The shared global room could potentially allow anyone access, but the token did not provide any additional security for individual rooms.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
