socketio · Jun 29, 2023 · Jul 9, 2023 · Jul 21, 2023 · Aug 2, 2023 · Aug 2, 2023
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -2,6 +2,7 @@
 
 ## 2023
 
+- [4.7.2](#472-2023-08-02) (Aug 2023)
 - [4.7.1](#471-2023-06-28) (Jun 2023)
 - [4.7.0](#470-2023-06-22) (Jun 2023)
 - [4.6.2](#462-2023-05-31) (May 2023)
@@ -60,6 +61,23 @@
 
 # Release notes
 
+## [4.7.2](https://github.com/socketio/socket.io/compare/4.7.1...4.7.2) (2023-08-02)
+
+
+### Bug Fixes
+
+* clean up child namespace when client is rejected in middleware ([#4773](https://github.com/socketio/socket.io/issues/4773)) ([0731c0d](https://github.com/socketio/socket.io/commit/0731c0d2f497d5cce596ea1ec32a67c08bcccbcd))
+* **webtransport:** properly handle WebTransport-only connections ([3468a19](https://github.com/socketio/socket.io/commit/3468a197afe87e65eb0d779fabd347fe683013ab))
+* **webtransport:** add proper framing ([a306db0](https://github.com/socketio/engine.io/commit/a306db09e8ddb367c7d62f45fec920f979580b7c))
+
+
+### Dependencies
+
+- [`engine.io@~6.5.2`](https://github.com/socketio/engine.io/releases/tag/6.5.2) ([diff](https://github.com/socketio/engine.io/compare/6.5.0...6.5.2))
+- [`ws@~8.11.0`](https://github.com/websockets/ws/releases/tag/8.11.0) (no change)
+
+
+
 ## [4.7.1](https://github.com/socketio/socket.io/compare/4.7.0...4.7.1) (2023-06-28)
 
 The client bundle contains a few fixes regarding the WebTransport support.

diff --git a/client-dist/socket.io.esm.min.js b/client-dist/socket.io.esm.min.js
diff --git a/client-dist/socket.io.esm.min.js.map b/client-dist/socket.io.esm.min.js.map
diff --git a/client-dist/socket.io.js b/client-dist/socket.io.js
diff --git a/client-dist/socket.io.js.map b/client-dist/socket.io.js.map
diff --git a/client-dist/socket.io.min.js b/client-dist/socket.io.min.js
diff --git a/client-dist/socket.io.min.js.map b/client-dist/socket.io.min.js.map
diff --git a/client-dist/socket.io.msgpack.min.js b/client-dist/socket.io.msgpack.min.js
diff --git a/client-dist/socket.io.msgpack.min.js.map b/client-dist/socket.io.msgpack.min.js.map
diff --git a/examples/webtransport/.gitignore b/examples/webtransport/.gitignore
@@ -0,0 +1 @@
+*.pem
diff --git a/examples/webtransport/README.md b/examples/webtransport/README.md
@@ -0,0 +1,18 @@
+
+# Socket.IO WebTransport example
+
+## How to use
+
+```shell
+# generate a self-signed certificate
+$ ./generate_cert.sh
+
+# install dependencies
+$ npm i
+
+# start the server
+$ node index.js
+
+# open a Chrome browser
+$ ./open_chrome.sh
+```
diff --git a/examples/webtransport/generate_cert.sh b/examples/webtransport/generate_cert.sh
@@ -0,0 +1,8 @@
+#!/bin/bash
+openssl req -new -x509 -nodes \
+    -out cert.pem \
+    -keyout key.pem \
+    -newkey ec \
+    -pkeyopt ec_paramgen_curve:prime256v1 \
+    -subj '/CN=127.0.0.1' \
+    -days 14
diff --git a/examples/webtransport/index.html b/examples/webtransport/index.html
@@ -0,0 +1,35 @@
+<!doctype html>
+<html lang="en">
+  <head>
+    <meta charset="UTF-8">
+    <title>Socket.IO WebTransport exampleqg</title>
+  </head>
+  <body>
+    <script src="/socket.io/socket.io.js"></script>
+    <script>
+      const socket = io({
+        transportOptions: {
+          webtransport: {
+            hostname: "127.0.0.1"
+          }
+        }
+      });
+
+      socket.on("connect", () => {
+        console.log(`connect ${socket.id}`);
+
+        socket.io.engine.on("upgrade", (transport) => {
+          console.log(`transport upgraded to ${transport.name}`);
+        });
+      });
+
+      socket.on("connect_error", (err) => {
+        console.log(`connect_error due to ${err.message}`);
+      });
+
+      socket.on("disconnect", (reason) => {
+        console.log(`disconnect due to ${reason}`);
+      });
+    </script>
+  </body>
+</html>
diff --git a/examples/webtransport/index.js b/examples/webtransport/index.js
@@ -0,0 +1,68 @@
+import { readFileSync } from "node:fs";
+import { createServer } from "node:https";
+import { Server } from "socket.io";
+import { Http3Server } from "@fails-components/webtransport";
+
+const key = readFileSync("./key.pem");
+const cert = readFileSync("./cert.pem");
+
+const httpsServer = createServer({
+  key,
+  cert
+}, (req, res) => {
+  if (req.method === "GET" && req.url === "/") {
+    const content = readFileSync("./index.html");
+    res.writeHead(200, {
+      "content-type": "text/html"
+    });
+    res.write(content);
+    res.end();
+  } else {
+    res.writeHead(404).end();
+  }
+});
+
+const io = new Server(httpsServer, {
+  transports: ["polling", "websocket", "webtransport"]
+});
+
+const port = process.env.PORT || 3000;
+
+io.on("connection", (socket) => {
+  console.log(`connect ${socket.id}`);
+
+  socket.conn.on("upgrade", (transport) => {
+    console.log(`transport upgraded to ${transport.name}`);
+  });
+
+  socket.on("disconnect", (reason) => {
+    console.log(`disconnect ${socket.id} due to ${reason}`);
+  });
+});
+
+httpsServer.listen(port, () => {
+  console.log(`server listening at https://localhost:${port}`);
+});
+
+const h3Server = new Http3Server({
+  port,
+  host: "0.0.0.0",
+  secret: "changeit",
+  cert,
+  privKey: key,
+});
+
+(async () => {
+  const stream = await h3Server.sessionStream("/socket.io/");
+  const sessionReader = stream.getReader();
+
+  while (true) {
+    const { done, value } = await sessionReader.read();
+    if (done) {
+      break;
+    }
+    io.engine.onWebTransportSession(value);
+  }
+})();
+
+h3Server.startServer();
diff --git a/examples/webtransport/open_chrome.sh b/examples/webtransport/open_chrome.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+HASH=`openssl x509 -pubkey -noout -in cert.pem |
+   openssl pkey -pubin -outform der |
+   openssl dgst -sha256 -binary |
+   base64`
+
+/opt/google/chrome/chrome \
+    --origin-to-force-quic-on=127.0.0.1:3000 \
+    --ignore-certificate-errors-spki-list=$HASH \
+    https://localhost:3000
diff --git a/examples/webtransport/package.json b/examples/webtransport/package.json
@@ -0,0 +1,11 @@
+{
+  "name": "webtransport",
+  "version": "0.0.1",
+  "description": "",
+  "private": true,
+  "type": "module",
+  "dependencies": {
+    "@fails-components/webtransport": "^0.1.7",
+    "socket.io": "^4.7.1"
+  }
+}
diff --git a/lib/socket.ts b/lib/socket.ts
@@ -292,16 +292,16 @@ export class Socket<
    */
   private buildHandshake(auth: object): Handshake {
     return {
-      headers: this.request.headers,
+      headers: this.request?.headers || {},
       time: new Date() + "",
       address: this.conn.remoteAddress,
-      xdomain: !!this.request.headers.origin,
+      xdomain: !!this.request?.headers.origin,
       // @ts-ignore
-      secure: !!this.request.connection.encrypted,
+      secure: !this.request || !!this.request.connection.encrypted,
       issued: +new Date(),
-      url: this.request.url!,
+      url: this.request?.url!,
       // @ts-ignore
-      query: this.request._query,
+      query: this.request?._query || {},
       auth,
     };
   }
@@ -758,7 +758,6 @@ export class Socket<
     }
 
     this._cleanup();
-    this.nsp._remove(this);
     this.client._remove(this);
     this.connected = false;
     this.emitReserved("disconnect", reason, description);
@@ -772,6 +771,7 @@ export class Socket<
    */
   _cleanup() {
     this.leaveAll();
+    this.nsp._remove(this);
     this.join = noop;
   }
 

diff --git a/package-lock.json b/package-lock.json
diff --git a/package.json b/package.json
@@ -1,6 +1,6 @@
 {
   "name": "socket.io",
-  "version": "4.7.1",
+  "version": "4.7.2",
   "description": "node.js realtime framework server",
   "keywords": [
     "realtime",
@@ -50,7 +50,7 @@
     "base64id": "~2.0.0",
     "cors": "~2.8.5",
     "debug": "~4.3.2",
-    "engine.io": "~6.5.0",
+    "engine.io": "~6.5.2",
     "socket.io-adapter": "~2.5.2",
     "socket.io-parser": "~4.2.4"
   },
@@ -61,7 +61,7 @@
     "nyc": "^15.1.0",
     "prettier": "^2.3.2",
     "rimraf": "^3.0.2",
-    "socket.io-client": "4.7.1",
+    "socket.io-client": "4.7.2",
     "socket.io-client-v2": "npm:socket.io-client@^2.4.0",
     "superagent": "^8.0.0",
     "supertest": "^6.1.6",
@@ -89,7 +89,7 @@
     }
   ],
   "engines": {
-    "node": ">=10.0.0"
+    "node": ">=10.2.0"
   },
   "tsd": {
     "directory": "test"

diff --git a/test/namespaces.ts b/test/namespaces.ts
@@ -653,6 +653,76 @@ describe("namespaces", () => {
       io.of(/^\/dynamic-\d+$/);
     });
 
+    it("should NOT clean up namespace when cleanupEmptyChildNamespaces is OFF and client is rejected in middleware", (done) => {
+      const io = new Server(0, { cleanupEmptyChildNamespaces: false });
+      io.of(/^\/dynamic-\d+$/).use((socket, next) => {
+        next(new Error("You shall not pass!"));
+      });
+      const c1 = createClient(io, "/dynamic-101");
+
+      c1.on("connect", () => {
+        done(new Error("Should not connect"));
+      });
+
+      c1.on("connect_error", () => {
+        setTimeout(() => {
+          expect(io._nsps.has("/dynamic-101")).to.be(true);
+          expect(io._nsps.get("/dynamic-101")!.sockets.size).to.be(0);
+          success(done, io, c1);
+        }, 100);
+      });
+    });
+
+    it("should clean up namespace when cleanupEmptyChildNamespaces is ON and client is rejected in middleware", (done) => {
+      const io = new Server(0, { cleanupEmptyChildNamespaces: true });
+      io.of(/^\/dynamic-\d+$/).use((socket, next) => {
+        next(new Error("You shall not pass!"));
+      });
+      const c1 = createClient(io, "/dynamic-101");
+
+      c1.on("connect", () => {
+        done(new Error("Should not connect"));
+      });
+
+      c1.on("connect_error", () => {
+        setTimeout(() => {
+          expect(io._nsps.has("/dynamic-101")).to.be(false);
+          success(done, io, c1);
+        }, 100);
+      });
+    });
+
+    it("should NOT clean up namespace when cleanupEmptyChildNamespaces is ON and client is rejected in middleware but there are other clients connected", (done) => {
+      const io = new Server(0, { cleanupEmptyChildNamespaces: true });
+      let clientIdxToReject = 0;
+      io.of(/^\/dynamic-\d+$/).use((socket, next) => {
+        if (clientIdxToReject) {
+          next(new Error("You shall not pass!"));
+        } else {
+          next();
+        }
+        clientIdxToReject++;
+      });
+      const c1 = createClient(io, "/dynamic-101");
+
+      c1.on("connect", () => {
+        const c2 = createClient(io, "/dynamic-101");
+        c2.on("connect", () => {
+          done(new Error("Client 2 should not connect"));
+        });
+        c2.on("connect_error", () => {
+          setTimeout(() => {
+            expect(io._nsps.has("/dynamic-101")).to.be(true);
+            expect(io._nsps.get("/dynamic-101")!.sockets.size).to.be(1);
+            success(done, io, c1, c2);
+          }, 100);
+        });
+      });
+      c1.on("connect_error", () => {
+        done(new Error("Client 1 should not get an error"));
+      });
+    });
+
     it("should attach a child namespace to its parent upon manual creation", () => {
       const io = new Server(0);
       const parentNamespace = io.of(/^\/dynamic-\d+$/);

diff --git a/test/socket.ts b/test/socket.ts
@@ -684,6 +684,23 @@ describe("socket", () => {
     });
   });
 
+  it("should handshake a client without access to the Engine.IO request (WebTransport-only connection)", (done) => {
+    const io = new Server(0);
+    const clientSocket = createClient(io, "/");
+
+    io.engine.on("connection", (socket) => {
+      delete socket.request;
+    });
+
+    io.on("connection", (socket) => {
+      expect(socket.handshake.secure).to.be(true);
+      expect(socket.handshake.headers).to.eql({});
+      expect(socket.handshake.query).to.eql({});
+
+      success(done, io, clientSocket);
+    });
+  });
+
   it("should handle very large json", function (done) {
     this.timeout(30000);
     const io = new Server(0, { perMessageDeflate: false });