Live data from Hacker News

Server-Sent Events: an alternative to WebSockets

germano.dev

21–30 of 266 posts

Re: Server-Sent Events: an alternative to WebSockets

#21
Very easy to implement - still using code I wrote 8 years ago, which is like 20 lines client and server, choosing it at the time over ws.

Essentially just new EventSource(), text/event-stream header, and keep conn open. Zero dependencies in browser and nodejs. Needs no separate auth.

Re: Server-Sent Events: an alternative to WebSockets

#22
post #19
post #7

Earlier quoted context omitted.

How do you mean lack of headers and cookies? That is wrong. Edit: Actually it seems correct (a javascript problem, not SSE problem) but it's a non-problem if you use a parameter for that data instead and read it on the server.

You cannot send custom headers when using the built-in EventSource[1] constructor, however you can pass the ‘include’ value to the credentials option. Many polyfills allow custom headers. However you are correct that if you’re not using JavaScript and connecting directly to the SSE endpoint via something else besides a browser client, nothing is preventing anyone from using custom headers. [1] https://developer.mozil…

I’m pretty sure I saw him sending headers in the talk. Did you watch the talk?

Re: Server-Sent Events: an alternative to WebSockets

#23
post #19
post #7

Earlier quoted context omitted.

How do you mean lack of headers and cookies? That is wrong. Edit: Actually it seems correct (a javascript problem, not SSE problem) but it's a non-problem if you use a parameter for that data instead and read it on the server.

You cannot send custom headers when using the built-in EventSource[1] constructor, however you can pass the ‘include’ value to the credentials option. Many polyfills allow custom headers. However you are correct that if you’re not using JavaScript and connecting directly to the SSE endpoint via something else besides a browser client, nothing is preventing anyone from using custom headers. [1] https://developer.mozil…

Aha, well why do you need to send a header when you can just put the data on the GET URL like so "blabla?cookie=erWR32" for example?

In my example I use this code:

        var source = new EventSource('pull?name=one');
        source.onmessage = function (event) {
           document.getElementById('events').innerHTML += event.data;
        };

Re: Server-Sent Events: an alternative to WebSockets

#24
I have used SSEs extensively, I think they are brilliant and massively underused.

The one thing I wish they supported was a binary event data type (mixed in with text events), effectively being able to send in my case image data as an event. The only way to do it currently is as a Base64 string.

Re: Server-Sent Events: an alternative to WebSockets

#27
I’m a huge fan of SSE. In the first chapter of my book Fullstack Node.js I use it for the real-time chat example because it requires almost zero setup. I’ve also been using SSE on https://rambly.app to handle all the WebRTC signaling so that clients can find new peers. Works great.

Re: Server-Sent Events: an alternative to WebSockets

#28
post #19

Earlier quoted context omitted.

You cannot send custom headers when using the built-in EventSource[1] constructor, however you can pass the ‘include’ value to the credentials option. Many polyfills allow custom headers. However you are correct that if you’re not using JavaScript and connecting directly to the SSE endpoint via something else besides a browser client, nothing is preventing anyone from using custom headers. [1] https://developer.mozil…

I’m pretty sure I saw him sending headers in the talk. Did you watch the talk?

He was likely using a polyfill. It’s definitely not in the spec and there’s an open discussion about trying to get it added: https://github.com/whatwg/html/issues/2177

Re: Server-Sent Events: an alternative to WebSockets

#29
post #23
post #19

Earlier quoted context omitted.

You cannot send custom headers when using the built-in EventSource[1] constructor, however you can pass the ‘include’ value to the credentials option. Many polyfills allow custom headers. However you are correct that if you’re not using JavaScript and connecting directly to the SSE endpoint via something else besides a browser client, nothing is preventing anyone from using custom headers. [1] https://developer.mozil…

Aha, well why do you need to send a header when you can just put the data on the GET URL like so "blabla?cookie=erWR32" for example? In my example I use this code: var source = new EventSource('pull?name=one'); source.onmessage = function (event) { document.getElementById('events').innerHTML += event.data; };

I think that works great! The complaint I’ve heard is that you may need to support multiple ways to authenticate opening up more attack surface.

Re: Server-Sent Events: an alternative to WebSockets

#30
post #23
post #19

Earlier quoted context omitted.

You cannot send custom headers when using the built-in EventSource[1] constructor, however you can pass the ‘include’ value to the credentials option. Many polyfills allow custom headers. However you are correct that if you’re not using JavaScript and connecting directly to the SSE endpoint via something else besides a browser client, nothing is preventing anyone from using custom headers. [1] https://developer.mozil…

Aha, well why do you need to send a header when you can just put the data on the GET URL like so "blabla?cookie=erWR32" for example? In my example I use this code: var source = new EventSource('pull?name=one'); source.onmessage = function (event) { document.getElementById('events').innerHTML += event.data; };

What if you use http-only cookies?
Post reply on HN