Subscriber Black- and Whitelisting
Subscriber Black-/Whitelisting is a feature from the WAMP Advanced Profile. The specification can be found here.
As per default, whenever there is a publication to a topic, a PubSub event is dispatched to all (authorized) subscribers to that topic other than the publisher itself. Subscriber Black- and White- listing restricts the set of subscribers who receive events for a particular publication.
There are three ways to do blacklisting:
exclude (using a list of session IDs to exclude),
exclude_authid (using a list of authentication IDs to exclude) and
exclude_authrole (using a list of authentication roles to exclude); and three corresponding ways to do whitelisting:
For a frontend with state synchronized across devices, a device on which an update is made may communicate this via an RPC to the backend. The local change may be effected as soon as the user input is made, with a possible rollback should the RPC fail. The other devices receive the update based on a successfully processed user input from the backend. In this case the backend will want to exclude the source device for the user input from the update.
If you have a list of sessions to exclude from a publication, you should pass a list of session-id's to
exclude; if any of those sessions are subscribers, they will not receive this publish.
You can also exclude sessions with
exclude_authrole. These options take a string or list of strings representing sessions to remove from the receivers. Thus any subscribers with the corresponding
authrole) will not receive this publish.
Whitelisting is the inverse of blacklisting: you specify the set of subscribers who may receive the publish instead of saying who may not.
If you have a list of sessions who could receive a publication, you should pass a list of session-id's to the
eligible option; only these sessions will possibly be able to receive the publish. This is a filtering operation, so they won't all necessarily receive the publish -- they still need to subscribe, for example.
You can also filter by
eligible_authrole. These options both take either a single string or a list of strings representing an assigned
authrole and work similarly. Of all the subscribers, only those without the correct
authrole) will get the publish.
Getting Session IDs¶
Subscriber Session IDs, which are used in Subscriber Black- and Whitelisting, can be communicated to application components via application-level messages. Components should be able to retrieve their WAMP Session ID - e.g. in Autobahn|JS, it's stored in
Additionally, Crossbar.io has Subscription Meta-Events and Procedures which allow the retrieval of this information from the router.Top