Websockets does not check .acl #1334

Activity

1. jaxoncreed

   self-assigned this

   on Oct 30, 2019
2. michielbdejong commented on Sep 28, 2020

   

   michielbdejong

   on Sep 28, 2020

   Member

   More actions

   See also https://github.com/solid/specification/issues/52#issuecomment-682491952

   👀React with 👀1Reacted by Andreas Kuckartz
3. melvincarvalho commented on Oct 10, 2024

   

   melvincarvalho

   on Oct 10, 2024

   Contributor

   More actions

   Can I just check to see we are talking about the websockets in:

   https://github.com/nodeSolidServer/node-solid-ws

   I have tested this now with two fresh apps, and I'm happy to report it's still working very well.

   Is the issue that we should do an ACL check on the resource before sending a pub notification? That sounds like it would be a good idea.
4. melvincarvalho commented on Jan 7, 2026

   

   melvincarvalho

   on Jan 7, 2026

   Contributor

   More actions

   Hey all! 👋

   Just wanted to share a possible approach for this - turns out the fix is pretty straightforward: check WAC read permission on each sub command. If authorized, send ack as usual. If not, send err <url> forbidden. Fully backwards-compatible.

   Happy to take a stab at a PR if that would be helpful!

   Thanks to everyone who's contributed to this discussion over the years - it helped clarify what the fix needed to be. 🙏
5. melvincarvalho

   added a commit that references this issue on Jan 7, 2026

   security: add ACL check for WebSocket subscriptions

   ...

   This issue will close once commit 03b5ff4 is merged into the 'master' branch.

   03b5ff4