Socket.IO room join authorization configuration

Developers using Socket.IO rooms often need to verify that a client is allowed to join a specific room before the socket is added to the room registry.

The library currently adds the socket to any room name emitted in a 'join' event without checking application‑level permissions, which can lead to stale cache assumptions if the client believes it joined a room it is not authorized for.

Because there is no built‑in middleware or hook for the join operation, each project must implement its own authorization logic in the connection handler or a custom listener.

Should Socket.IO provide an optional authorization callback for room join events?

What parameters (socket, room name, namespace) should the callback receive?

How would the callback be registered and what would be the default behavior if it is omitted?