Zero-Trust Security

Channel Authorization & Signatures

Securing private and presence channels using cryptographic HMAC-SHA256 signatures.

Authorization Protocol Flow

When a client subscribes to a channel starting with private- or presence-, authorization is enforced:

1.Client connects and obtains a cluster-unique socket_id.

2.Client POSTs socket_id and channel_name to your backend auth route.

3.Your backend verifies session identity and signs the string with your secret key.

4.Realtime cluster validates signature and admits the connection into the channel.

Backend HMAC-SHA256 Signing Logic

// Private channel string:
stringToSign = socket_id + ":" + channel_name;

// Presence channel string:
stringToSign = socket_id + ":" + channel_name + ":" + channel_data;

// Compute HMAC-SHA256:
signature = hex(hmac_sha256(secret_key, stringToSign));

// Return to client:
auth = public_key + ":" + signature;