I am studying socket.io and ended up making a connection using react as front end js and how to back end node js

I was successful but I have a question as to how I made my code I don't know if it's "safe" or if I could improve on something

in my back end i have this on my app.js:

Here I call my router and pass my io / socket

const express = require('express');
const bodyParser = require('body-parser');
const port = 8080;
const  cors = require('cors');
const socketRouter = require('./routes/socket');
const usersRouter = require('./routes/userRoutes');
const postRouter = require('./routes/post');
const matchRouter = require('./routes/matchRoutes');
const app = express();
const router = express.Router();

const socket = require('socket.io');

const server = app.listen(
  console.log(`Server running in ${process.env.NODE_ENV} mode on port ${port}`)

  let io = require('socket.io')(server);
  app.set("io", io);


e em meu arquivo de router:

const socketController = require ('../controllers/SocketController');
const verify = require('../auth/index');
module.exports = {    
   configuration: (io,socket) => {        
      io.on('connection', (socket) => {
         socket.on('test', async (token,message) => {
            const tokenVerify = await verify.authSocket(token);
               console.log(`Socket id: ${socket.id}`)
               socket.emit('myevent', {message: 'OK'});

And on my router I get the socket and the io I take my token / message that I send through my front end and do a verification

with this function :

async authSocket(token){
    if(!token) return res.status(401).json('Unauthorized');
        const decoded = jwt.verify(token,config.secretToken);
            return true;

in my front end i have this:

verify = () => {
        let socket = null;
        socket = io.connect('http://localhost:8080/');
        const message = {
            nome: 'testando',
            message: 'dasuidhjasu'
        socket.emit('test',JSON.parse(sessionStorage.getItem('token')), message)

And as a result I get it

enter image description here

But as I said I don't know if my code is correct or if I could improve on something, I would be happy if they could help me

and I also have a question:

I wish this was my socket connection method (ie if my jwt is not valid, don't open a connection)

But if it is valid and I want to send new issues as I would so that no longer need to be authenticated

  • \$\begingroup\$ You say you don't know if your code is correct. Did you test the output? What did you want it to be? Regarding whether your code is safe or not, well, it's not doing much of anything at the moment. What attacks are you concerned about? \$\endgroup\$ – Mast Nov 20 '19 at 18:27
  • \$\begingroup\$ I don't know very well, it's more to know if I had a good logic doing this or if I can improve, I wanted to authenticate my jwt when I use io.on ('connection', (socket) => { and not when I use the event test but I am wondering how I will pass my token to the connection so I only need to authenticate once \$\endgroup\$ – gabriel Nov 20 '19 at 18:44
  • \$\begingroup\$ Because this way I think I would have to do an authentication every event I have and not just when I connect \$\endgroup\$ – gabriel Nov 20 '19 at 18:46