gem-hunter

Available as part of the Tidelift Subscription.

The maintainers of SockJS and thousands of other packages are working with Tidelift to deliver commercial support and maintenance for the open source dependencies you use to build your applications. Save time, reduce risk, and improve code health, while paying the maintainers of the exact dependencies you use. Learn more.

SockJS is a browser JavaScript library that provides a WebSocket-like object. SockJS gives you a coherent, cross-browser, Javascript API which creates a low latency, full duplex, cross-domain communication channel between the browser and the web server.

Under the hood SockJS tries to use native WebSockets first. If that fails it can use a variety of browser-specific transport protocols and presents them through WebSocket-like abstractions.

SockJS is intended to work for all modern browsers and in environments which don't support the WebSocket protocol -- for example, behind restrictive corporate proxies.

SockJS-client does require a server counterpart:

• SockJS-node is a SockJS server for Node.js.

Philosophy:

• The API should follow HTML5 Websockets API as closely as possible.
• All the transports must support cross domain connections out of the box. It's possible and recommended to host a SockJS server on a different server than your main web site.
• There is support for at least one streaming protocol for every major browser.
• Streaming transports should work cross-domain and should support cookies (for cookie-based sticky sessions).
• Polling transports are used as a fallback for old browsers and hosts behind restrictive proxies.
• Connection establishment should be fast and lightweight.
• No Flash inside (no need to open port 843 - which doesn't work through proxies, no need to host 'crossdomain.xml', no need to wait for 3 seconds in order to detect problems)

Subscribe to SockJS mailing list for discussions and support.

• SockJS-client JavaScript client library
• SockJS-node Node.js server
• SockJS-erlang Erlang server
• SockJS-cyclone Python/Cyclone/Twisted server
• SockJS-tornado Python/Tornado server
• SockJS-twisted Python/Twisted server
• SockJS-aiohttp Python/Aiohttp server
• Spring Framework Java client & server
• vert.x Java/vert.x server
• Xitrum Scala server
• Atmosphere Framework JavaEE Server, Play Framework, Netty, Vert.x
• Actix SockJS Rust Server, Actix Framework

Work in progress:

• SockJS-ruby
• SockJS-netty
• SockJS-gevent (SockJS-gevent fork)
• pyramid-SockJS
• wildcloud-websockets
• wai-SockJS
• SockJS-perl
• SockJS-go
• syp.biz.SockJS.NET - .NET port of the SockJS client

SockJS mimics the WebSockets API, but instead of WebSocket there is a SockJS Javascript object.

First, you need to load the SockJS JavaScript library. For example, you can put that in your HTML head:

<script src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"></script>

After the script is loaded you can establish a connection with the SockJS server. Here's a simple example:

 var sock = new SockJS('https://mydomain.com/my_prefix');
 sock.onopen = function() {
     console.log('open');
     sock.send('test');
 };

 sock.onmessage = function(e) {
     console.log('message', e.data);
     sock.close();
 };

 sock.onclose = function() {
     console.log('close');
 };

Similar to the 'WebSocket' API, the 'SockJS' constructor takes one or more arguments:

var sockjs = new SockJS(url, _reserved, options);

url may contain a query string, if one is desired.

Where options is a hash which can contain:

• server (string)

  String to append to url for actual data connection. Defaults to a random 4 digit number.

• transports (string OR array of strings)

  Sometimes it is useful to disable some fallback transports. This option allows you to supply a list transports that may be used by SockJS. By default all available transports will be used.

• sessionId (number OR function)

  Both client and server use session identifiers to distinguish connections. If you specify this option as a number, SockJS will use its random string generator function to generate session ids that are N-character long (where N corresponds to the number specified by sessionId). When you specify this option as a function, the function must return a randomly generated string. Every time SockJS needs to generate a session id it will call this function and use the returned string directly. If you don't specify this option, the default is to use the default random string generator to generate 8-character long session ids.

• timeout (number)

  Specify a minimum timeout in milliseconds to use for the transport connections. By default this is dynamically calculated based on the measured RTT and the number of expected round trips. This setting will establish a minimum, but if the calculated timeout is higher, that will be used.

Although the 'SockJS' object tries to emulate the 'WebSocket' behaviour, it's impossible to support all of its features. An important SockJS limitation is the fact that you're not allowed to open more than one SockJS connection to a single domain at a time. This limitation is caused by an in-browser limit of outgoing connections - usually browsers don't allow opening more than two outgoing connections to a single domain. A single SockJS session requires those two connections - one for downloading data, the other for sending messages. Opening a second SockJS session at the same time would most likely block, and can result in both sessions timing out.

Opening more than one SockJS connection at a time is generally a bad practice. If you absolutely must do it, you can use multiple subdomains, using a different subdomain for every SockJS connection.

sock.send(data) returns a boolean:

• true - the message was accepted by the transport;
• false - it was not, and the application should stop sending for now.

A false is returned for two different reasons, and only one of them is followed by a drain event:

• the connection is not open (readyState is CLOSING or CLOSED) - the connection is gone and no drain event will ever be dispatched;
• the transport is applying backpressure, i.e. its write buffer is full - a drain event is dispatched on the SockJS object once more data can be accepted.

This mirrors the contract of Node's Writable#write / faye-websocket's send, and makes it possible to pipe a producer into a SockJS connection without buffering an unbounded amount of data in memory:

var stream = fs.createReadStream('huge-file');

function resume() {
  stream.resume();
}

stream.on('data', function(chunk) {
  if (!sock.send(chunk)) {
    // The transport can't take any more right now: stop producing.
    stream.pause();
  }
});

sock.addEventListener('drain', resume);
sock.ondrain = resume;                 // same thing, both forms work
sock.addEventListener('close', function() {
  // `false` can also mean "the connection is gone", in which case no `drain`
  // will ever arrive - handling `close` is required, not optional.
  stream.destroy();
});

drain is not the only resume signal: close (and onclose) must be handled as well, because a false caused by a closed connection will never be followed by a drain. In other words, false means "buffer full or not open", and both cases have to be dealt with by the caller.

Only the Node websocket transport reports backpressure today, because it is the only one whose underlying socket exposes it. Every other transport reports true unconditionally, which means "accepted", not "delivered". In particular the browser websocket transport hands off to the native WebSocket (which buffers internally), and the polling/streaming transports queue messages in an unbounded JavaScript array - so they can lose data in exactly the same way when the connection goes away with a backlog still pending.

Note that this is a deliberate deviation from the WebSocket API, where send() returns undefined and backpressure is signalled through bufferedAmount instead of a return value plus a drain event.

• †: IE 8+ supports [XDomainRequest]¹, which is essentially a modified AJAX/XHR that can do requests across domains. But unfortunately it doesn't send any cookies, which makes it inappropriate for deployments when the load balancer uses JSESSIONID cookie to do sticky sessions.

• ‡: Firefox 4.0 and Opera 11.00 and shipped with disabled Websockets "hixie-76". They can still be enabled by manually changing a browser setting.

Sometimes you may want to serve your html from "file://" address - for development or if you're using PhoneGap or similar technologies. But due to the Cross Origin Policy files served from "file://" have no Origin, and that means some of SockJS transports won't work. For this reason the SockJS transport table is different than usually, major differences are:

Although the main point of SockJS is to enable browser-to-server connectivity, it is possible to connect to SockJS from an external application. Any SockJS server complying with 0.3 protocol does support a raw WebSocket url. The raw WebSocket url for the test server looks like:

• ws://localhost:8081/echo/websocket

You can connect any WebSocket RFC 6455 compliant WebSocket client to this url. This can be a command line client, external application, third party code or even a browser (though I don't know why you would want to do so).

You should use a version of sockjs-client that supports the protocol used by your server. For example:

<script src="https://cdn.jsdelivr.net/npm/sockjs-client@1/dist/sockjs.min.js"></script>

For server-side deployment tricks, especially about load balancing and session stickiness, take a look at the SockJS-node readme.

SockJS-client needs node.js for running a test server and JavaScript minification. If you want to work on SockJS-client source code, checkout the git repo and follow these steps:

cd sockjs-client
npm install

To generate JavaScript, run:

gulp browserify

To generate minified JavaScript, run:

gulp browserify:min

Both commands output into the build directory.

Automated testing provided by:

Once you've compiled the SockJS-client you may want to check if your changes pass all the tests.

npm run test:browser_local

This will start karma and a test support server.

There are various browser quirks which we don't intend to address:

• Pressing ESC in Firefox, before Firefox 20, closes the SockJS connection. For a workaround and discussion see #18.
• jsonp-polling transport will show a "spinning wheel" (aka. "busy indicator") when sending data.
• You can't open more than one SockJS connection to one domain at the same time due to the browser's limit of concurrent connections (this limit is not counting native WebSocket connections).
• Although SockJS is trying to escape any strange Unicode characters (even invalid ones - like surrogates \xD800-\xDBFF or \xFFFE and \xFFFF) it's advisable to use only valid characters. Using invalid characters is a bit slower, and may not work with SockJS servers that have proper Unicode support.
• Having a global function called onmessage or such is probably a bad idea, as it could be called by the built-in postMessage API.
• From SockJS' point of view there is nothing special about SSL/HTTPS. Connecting between unencrypted and encrypted sites should work just fine.
• Although SockJS does its best to support both prefix and cookie based sticky sessions, the latter may not work well cross-domain with browsers that don't accept third-party cookies by default (Safari). In order to get around this make sure you're connecting to SockJS from the same parent domain as the main site. For example 'sockjs.a.com' is able to set cookies if you're connecting from 'www.a.com' or 'a.com'.
• Trying to connect from secure "https://" to insecure "http://" is not a good idea. The other way around should be fine.
• Long polling is known to cause problems on Heroku, but a workaround for SockJS is available.
• SockJS websocket transport is more stable over SSL. If you're a serious SockJS user then consider using SSL (more info).

Footnotes

1. https://blogs.msdn.microsoft.com/ieinternals/2010/05/13/xdomainrequest-restrictions-limitations-and-workarounds/ ↩ ↩² ↩³

2. https://www.rfc-editor.org/rfc/rfc6455.txt ↩

3. https://tools.ietf.org/html/draft-hixie-thewebsocketprotocol-76 ↩

4. https://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-10 ↩

5. https://secure.wikimedia.org/wikipedia/en/wiki/XMLHttpRequest#Cross-domain_requests ↩ ↩²

6. http://www.debugtheweb.com/test/teststreaming.aspx ↩ ↩²

7. https://html.spec.whatwg.org/multipage/comms.html#server-sent-events ↩ ↩²

8. https://developer.mozilla.org/en/DOM/window.postMessage ↩ ↩² ↩³

9. http://cometdaily.com/2007/11/18/ie-activexhtmlfile-transport-part-ii/ ↩ ↩²

10. https://secure.wikimedia.org/wikipedia/en/wiki/JSONP ↩