in src/socket-socketio.js [98:172]
socket.updateAuthHeaders = function(newToken) {
if (newToken && this.io) {
logger.warn('🔧 Socket.IO v4: AGGRESSIVELY updating ALL auth header locations with new token');
logger.debug('🔧 NEW Authorization header:', `Bearer ${newToken.substring(0, 30)}...`);
const newAuthHeader = `Bearer ${newToken}`;
let updateCount = 0;
// 1. Update socket.auth
if (this.auth) {
this.auth.auth_header = newToken;
updateCount++;
logger.debug('✅ Updated: socket.auth.auth_header');
}
// 2. Update engine.opts.extraHeaders (CRITICAL for polling transport!)
if (this.io.engine && this.io.engine.opts) {
if (!this.io.engine.opts.extraHeaders) {
this.io.engine.opts.extraHeaders = {};
}
this.io.engine.opts.extraHeaders.Authorization = newAuthHeader;
updateCount++;
logger.debug('✅ Updated: socket.io.engine.opts.extraHeaders');
}
// 3. Update manager.opts.extraHeaders
if (this.io.opts) {
if (!this.io.opts.extraHeaders) {
this.io.opts.extraHeaders = {};
}
this.io.opts.extraHeaders.Authorization = newAuthHeader;
updateCount++;
logger.debug('✅ Updated: socket.io.opts.extraHeaders');
if (!this.io.opts.auth) {
this.io.opts.auth = {};
}
this.io.opts.auth.auth_header = newToken;
updateCount++;
logger.debug('✅ Updated: socket.io.opts.auth.auth_header');
}
// 4. Update transport-level headers if transport is active
// NOTE: Do NOT use transport.query - it puts auth_header in GET params (security issue)
// For polling transport, extraHeaders (set above) is the correct way
// 5. NUCLEAR OPTION: Update global manager cache if it exists
if (typeof window !== 'undefined' && window.io && window.io.managers && this.io.uri) {
const managerKey = this.io.uri;
if (window.io.managers[managerKey]) {
const manager = window.io.managers[managerKey];
if (manager.opts) {
if (!manager.opts.extraHeaders) {
manager.opts.extraHeaders = {};
}
manager.opts.extraHeaders.Authorization = newAuthHeader;
updateCount++;
logger.debug('✅ Updated: global manager.opts.extraHeaders');
}
}
}
logger.info(`✅ Socket.IO v4: Updated ${updateCount} auth header locations`);
// Verification
const verifyHeader = this.io.engine?.opts?.extraHeaders?.Authorization;
if (verifyHeader === newAuthHeader) {
logger.info('✅ VERIFICATION PASSED: Engine has correct new token');
} else {
logger.error('❌ VERIFICATION FAILED after updateAuthHeaders!');
logger.error('❌ Expected:', newAuthHeader.substring(0, 50));
logger.error('❌ Got:', verifyHeader || 'NULL');
}
}
};