hapijs with socket.io the right way? - node.js

Question

I'm trying to use hapijs with socket.io and already searched a lot about how to integrate socket.io into the hapi server the right way. One approach, I found, is this example and I'm still not sure if this is the way to go. I have to admit that I'm new to hapijs and I'm still learning it :)
var Path = require('path');
var Hapi = require('hapi');
var socketio = require('socket.io');
var server = new Hapi.Server();
server.connection({port: 3000});
server.register(require('vision'), function (err) {
server.views({
engines: {
ejs: require('ejs')
},
relativeTo: __dirname,
path: 'templates'
});
});
var plugins = [
{register: require('./lib/index.js')}
];
server.register(plugins, function (err) {
server.start(function () {
io = socketio.listen(server.listener);
io.on('connection', function (socket) {
socket.on('create', function (room) {
socket.join(room);
console.log("Joined room: " + room);
socket.emit('message', "Joined room");
});
});
console.log('Server running at:', server.info.uri);
});
});
And the lib/index.js
exports.register = function(server, options, next) {
var tasks = [];
server.route([
{
method: 'GET',
path: '/tasks',
handler: function (request, reply) {
reply.view('index', { sid: "6001" });
io.emit('message', "Test");
}
},
{
method: 'POST',
path: '/tasks/{name}',
handler: function (request, reply) {
reply.view('index', { sid: "6001" });
io.emit('message', "Test");
}
},
{
method: 'POST',
path: '/tasks',
handler: function (request, reply) {
io.emit('message', "Test");
}
}
]);
next();
}
exports.register.attributes = {
name: 'routes-tasks',
version: '1.0.0'
};
Please correct me if this is not the way how to use hapijs.

Answer 1

you are near to it.
1)on disconnect close the sockets
socket.disconnect('unauthorized'); or socket.close();
2)use auth for every subscription
{
method: 'POST',
path: '/tasks/{name}',
auth: auth,
handler: function (request, reply) {
reply.view('index', { sid: "6001" });
io.emit('message', "Test");
}
},
3)must important thing is use Access-Control-Allow-Origin otherwise websocket hijacking will happen.
request.response.header('Access-Control-Allow-Origin', 'your domain')
if you need further info let me know.I am happy to help