Clients should not be allowed to leave or join "sid" rooms #10002

New issue

Closed

opened 2026-08-29 10:13:07 +00:00 by miguel · 0 comments

miguel commented

2026-08-29 10:13:07 +00:00

Owner

When a client connects to the server, it is put in a room that is specifically created for the client, and named with the connection's assigned sid. While these rooms are special, the server treats them as regular rooms, allowing users to leave or join these rooms as if they were custom rooms. To prevent problems, it would be best to consider these "sid" rooms read-only.

Reference: https://github.com/miguelgrinberg/Flask-SocketIO/issues/1283
Related: https://github.com/miguelgrinberg/python-socketio/issues/1447

When a client connects to the server, it is put in a room that is specifically created for the client, and named with the connection's assigned `sid`. While these rooms are special, the server treats them as regular rooms, allowing users to leave or join these rooms as if they were custom rooms. To prevent problems, it would be best to consider these "sid" rooms read-only. Reference: https://github.com/miguelgrinberg/Flask-SocketIO/issues/1283 Related: https://github.com/miguelgrinberg/python-socketio/issues/1447

miguel added the

enhancement

label

2026-08-29 10:14:28 +00:00

miguel referenced this issue from a commit

2026-09-04 23:04:59 +00:00

Do not allow users to join another user's sid room (Fixes #10002)

miguel closed this issue

2026-09-04 23:04:59 +00:00