How exactly does Server-Sent Events work?

Question

I am trying to get into the web push technology so I started looking around. I have basically found 2 technologies, that is Websockets and SSE. After ruling out Websockets because of lack of perl support, I wanted to try out the more native SSE-approach.

Now, trying to get SSE to work is a real pain in the arse. Every documentation has conflicting information and there does not seem to be a general consensus on how SSE works. Some say hat you need an <event-listen src="events.pm"> tag, others say you only need an EventSource JS object. Even with the EventSource object, I found around 4 possible implementations and none of them seem to work.

Here is what I have. I have an events.pm, which uses mod-perl. If you call that file, it returns data: I haz a websocket. That is sent with the content-type application/x-dom-event-stream.

The HTML and JS files have been rewritten so often with different implementations that I have given up on them. Can you guys please give me a working example?

Also: I do not understand how you can send specific messages to the client. Sending a predefined message seems to be fine. However, if I imagine a situation where someone sends me a message, I do not understand how exactly that information ('there is a new message for you') is transmitted to that exact browser that needs that information. Every post I found on this is vague at best.

EDIT

Basically, what I need is a way to say 'hey, are you allowed to get this notification? show me your id/session/token first!' on a per connected client basis. I wonder if it is at all possible with SSE.

Answer 1

I would say that Server-sent events are described pretty good in Stream Updates with Server-Sent Events article, namely the Event Stream Format. With Firefox 6 SSEs are now supported by majority of modern browsers (unfortunately except IE).

I do not understand how you can send specific messages to the client. Sending a predefined message seems to be fine. However, if I imagine a situation where someone sends me a message, I do not understand how exactly that information ('there is a new message for you') is transmitted to that exact browser that needs that information.

Clients are connected with the SSE server by keep-alive event stream, uni-directional connection which isn't closed until browser/tab is closed, user invokes close method or network connection is lost.

Basically, what I need is a way to say 'hey, are you allowed to get this notification? show me your id/session/token first!' on a per connected client basis. I wonder if it is at all possible with SSE.

This kind of authentication logic would be required to do on the server side, so it's dependent on the language or platform you are using. Unless there is library for that in your environment you would probably have to write it.

Answer 2

The spec has changed/evolved. Current version uses EventSource object. The HTML element is gone.

The current MIME type is text/event-stream. The x-dom-event-stream was used only in early implementations (Opera in 2006).

To identify/authenticate clients you can either use cookies or connect to an event stream URL that includes some kind of authentication token (session ID), and then you'll know that a particular TCP/IP connection is associated with that user.

http://html5doctor.com/server-sent-events/

Answer 3

Adding to @porneL's answer; you can tell EventSource to include cookies to the request it sends. Just create the EventSource object like this:

var evtsrc = new EventSource('./url_of/event_stream/',{withCredentials:true});

I tested this with latest version of chrome and firefox.

Source: http://www.sitepoint.com/server-sent-events/

edit: apparently this is not necessary / useless. See @Tamlyn's comment.