I am currently designing a system that lets users connect their Cloud Storage such as Google Drive, Dropbox etc and also to their physical filesystem (personal laptop/ ftp server etc.) and then can just open a single webpage page where he can find all the files in each of the storages and can download them. My system has 3 main components which are
- A front end UI which the user will use to view files from all the different storage providers (React frontend)
- A backend server which does authentication using a DB (Mongo) and once authenticated, creates connections to the different storage providers. (Nodejs server)
- A backend client to be run ONLY on the physical filesystem (personal laptop) which will connect to the server to provide the files in the file system. (Node js client server)
Now, I also provide the ability for multiple users to connect to the server, authenticate themselves and have access to their storage. (I decided to use the Google API and Dropbox API to connect to the server (using OAuth) and store their tokens in the DB so that they don't have to authenticate every time for fetching the files.)
So far, I think my design looks solid, except for the File System client part. I decided to use Web Sockets for this ie. the client will connect to the server by providing credentials, and once authenticated, the server will generate a unique UUID and store it along with the user details in the DB and also send the UUID to the client on successful authentication. The client will verify the token for every emit from the server. So now the flow is as
- Everytime the user requests a file from the FS (File System), he will send the token along with the emit request.
- The client verifies if the token matches with what it received during authentication and if true, will send the file.
Now, this is where my doubt is.
Since multiple users can be connected to the server and each might have their FS connection open using sockets, is it right that every time a user requests a file from his File System, all the other user's client also checks if their token matches?
I feel this part of the design is problematic.
Of course, inactive clients will timeout and their connection would be closed, but suppose if 1000 users are actively using the application, then whenever user 1 requests a file from his file system, the emitted event from the server with the UUID for user 1 would also trigger all the other 999 users to check if the token matches theirs.
Is there also a security concern here?
The only reason I wanted to have a socket connection is so that connecting the FS client to the server would require constant connection as long as the FS is alive and I don't know if HTTP requests would be secure as the port of the client would be exposed to the outside world.
Please give me your valuable thoughts on this.