rslay / zerochat

Live web chat. No scripts, cookies, accounts, or <meta> refreshing.

ZeroChat

Report a bug · Create a PR for contributions · Discussions

A live web chat. No client-side javascript, cookies, accounts, or <meta http-equiv="refresh"> tags.

Instead, your browser never finishes loading the whole page, and downloads messages as they are posted by others.

Authentification is done with a password/tripcode system using PBKDF2 hashes.

Try it by visiting chat.justhack.in

It's easy to self-host, and simple to use. Developed with a security-first mentality.

Run ZeroChat in just a few commands with Docker!

Username and Password? But no accounts required!

• You can login using a handle of your choosing, and enter a "passcode" which is hashed into a unique "tripcode" for your passcode only
• A passcode is like a password, but no accounts are needed to enter a room, everyone just proves who they are by their tripcode

Rooms

• Choose from a preselected list of "public" rooms that are advertised on the front page by clicking the Room textbox twice.
• Or, enter any name you want for your room, and you'll "tune" into it like a radio frequency.

You can share a link with /roomName at the end of the URL to have your friends join that room.

Wondering how it's a live chat without javascript?

Setup & Dependencies

This project requires NodeJS to run, unless you download one of the precompiled binary releases (Supported only on windows).

There are three different ways to run ZeroChat, read below.

Setup ZeroChat on Windows

Download from the releases for executable binaries if you just want to run the chat server.

If you want to tweak the program and run the source code on Windows with/without docker, continue below.

Self hosting setup with Docker

Run docker compose --env-file .env.example up.

docker ps should show you that the service is running!

Stop the service by running docker compose down.

Customizing

Copy .env.example to .env and use that if you'd like to change things.

Keep in mind that if you change the PORT, you should change the EXPOSE value in the Dockerfile and forwarded port in the docker-compose.yml.

Self Hosting setup without Docker

All you need is node, which comes with npm.

Run the following to install the wonderful nvm (for windows, windows-nvm) NodeJS version manager.

Then install NodeJS v16.2.0:

nvm install 16.2.0
nvm use 16.2.0

Finally, follow the steps below to set up and run ZeroChat.

💻 Installation and usage

Summary of the steps to be done:

git clone https://github.com/rslay/ZeroChat zerochat
cd zerochat
npm install
# Make an .env file and change the config, if needed
cp .env.example .env
npm run start

Explanation:

• Download the repo to your machine: git clone https://github.com/rslay/ZeroChat zerochat
  • Enter the new directory with cd zerochat
• Install the dependencies for the project using npm install or yarn install
• Configure the environmental variables by renaming the .env.example file to .env, e.g. for defaults: cp .env.example .env
  • If you're using a Platform as a Service (PaaS), such as AWS LightSail or Heroku, configure it using the service's environment variables settings based of values in the .env.example file, and refrain from using the .env file
• Run the server using npm run start

⚠ Common Issues

Nginx Issues

Proxying the requests through Nginx can be a bit problematic, since you have to turn proxy_buffering off; in your location {...} block.

Example:

server {
        server_name chat.example.com;
        location / {
                proxy_buffering off; # Fixes the issue!
                proxy_pass http://127.0.0.1:8000; # ZeroChat server running locally on port 8000
        }
        listen 80; # Nginx listening on port 80
}

🔮 Upcoming features

Check the following places:

• Issue Tracker
• Pull requests
• Discussions

🤝 Contributing

Contributions, issues, and feature requests are welcome. After cloning and setting up project locally, you can submit a PR to this repo and it will be deployed once it's accepted.

It’s good to have descriptive commit messages, or PR titles so that other contributors can better understand your commit or the PR Created. Read conventional commits before making the commit message.

📔 How it works

Here is the article that explains how the chat is live without javascript!

Show your support

We love people's support in growing and improving. Be sure to leave a ⭐️ if you like the project and also be sure to contribute, if you're interested!

zerochat's Issues

Switch to using an in-memory file system for file uploads

Probably not a good idea to store entire files as base64 data in variables and pass them through a bunch of functions - preferable to utilize an in-memory file system that only converts files to base64 when needed by the browser and to have it kept in one memory location in all other situations

Possible library option: https://github.com/streamich/memfs

Move over functions and constants to library, migrate CSS themes to files

Messages are never deleted server-side

Currently, messages are stored in the msg array as JSON, but never deleted or removed.
At an interval, these should be removed. Perhaps the messages should be stored on the heap, or maybe that is not the best approach. Some research will need to be done on how NodeJS handles memory allocation, and to make sure no memory leaks are happening.

Commands module, /pm and /me

Related to issue #2

Frequencies/Channels that users can tune into for private group chats

The concept of private/secret rooms seems like an ideal feature to have in case you want to have a private conversation with multiple people and PMs don't suffice.

Security audit and testing of program

Webapp pentesting is a skill that will be needed to make sure ZeroChat is a secure application. I am almost certain that there is something vulnerable - there are already more than 700 lines of code at the first commit.
I will prioritize the following:

• Research memory leaks and how to detect/exploit and avoid them or protect against exploitation
• Reduce code size and attack surface
• Make the program more modular so that debugging and bug hunting/fixing becomes easier
• Use fuzzers and try to break the server/take it down/inject malicious code
• Automatically detect and block DDoS attempts

Add CLI args to overrride env vars and default settings

Add a command line arguments, including:

• Setting listening port via a -p flag
• Enabling logging verbosity with -v flag and setting logging off by default

Add a rolling key for posting

Add a rolling identification key for posting, so that if the viewing key is compromised on the user's end, nobody can pretend to be them with an old key.
Since the passcode is already secured and only sent over once, this would be the next step to secure the identification method for users

Add: nginx proxy and guid

Hello, how i can to connect my domain to my website? I use cloudflare flexible SSL, and i need use domain name. How? If i use redirect, i take something strange - web is crashed when i try write message.
For example: https://hive.slainscraft.com/

Make chat and settings pane be more extendable/modular

Break up http live library froom chat business logic

Command-line args for some settings to overrride env vars and defaults

Private messaging between users

Make it possible for users in the same frequency/channel to send messages to each other privately

Limit filesize upload, stop in mutex from connection continuing

Users who try to upload files larger than given limit should have the upload stop if it goes past a certain filesize.

Optimal solution is to check filesize before letting the user start uploading, but it may not be that straightforward since clients can lie. Got to stop the upload the second it passes the filesize limit

In-chat settings iframe with ability to live-update CSS

In-chat settings iframe that updates CSS on chat body.
Should have options for:

• Hiding or showing file previews in the browser
• Let the user unload the chat history
• Change themes

Remove users after they disconnect

At the moment, users seem to stay in the chat, server-side, even after disconnecting.
There will need to be a remove of users once their connection is lost.

Limit max filesize upload (move logic to seperate file)

Use sandboxed iframes

Make iframes restricted and only able to submit forms.

Potentially, the chat itself could be moved off into an iframe for sandboxing user messages in case something is vulnerable, so that all attempts at XSS would be negated.

Plan out split of http live library and chat business logic

Migrate to ExpressJS

Move over codebase and HTTP requests to express.js, instead of just using the HTTP library available to NodeJS.