diff --git a/app/realtime.php b/app/realtime.php index da59197184..9e5486e638 100644 --- a/app/realtime.php +++ b/app/realtime.php @@ -939,27 +939,11 @@ $server->onMessage(function (int $connection, string $message) use ($server, $re $proofForToken = new Token(); $proofForToken->setHash(new Sha()); - $sessionSecret = $store->getProperty('secret', ''); - $userFound = !empty($user->getId()); - $sessionsInDoc = $userFound ? \count($user->getAttribute('sessions', [])) : 0; - $sessionVerified = $userFound && $user->sessionVerify($sessionSecret, $proofForToken); - - if (!$userFound || !$sessionVerified) { - $dbAdapter = $database->getAdapter(); - Console::warning(sprintf( - '[realtime-auth-diag] project=%s userId=%s userFound=%s sessions=%d secretPrefix=%s verified=%s db=%s ns=%s tenant=%s shared=%s host=%s', - $projectId ?? '(null)', - $userId, - $userFound ? 'yes' : 'no', - $sessionsInDoc, - \substr($sessionSecret, 0, 8), - $sessionVerified ? 'yes' : 'no', - $database->getDatabase(), - $database->getNamespace(), - $database->getTenant() ?? 'null', - $database->getSharedTables() ? 'yes' : 'no', - \method_exists($dbAdapter, 'getHostname') ? $dbAdapter->getHostname() : '?' - )); + if ( + empty($user->getId()) // Check a document has been found in the DB + || !$user->sessionVerify($store->getProperty('secret', ''), $proofForToken) // Validate user has valid login token + ) { + // cookie not valid throw new Exception(Exception::REALTIME_MESSAGE_FORMAT_INVALID, 'Session is not valid.'); }