Presence payloads contain only state and user ID; no IP, device, or session data leaked

Presence payloads broadcast to every connected client in a channel. Embedding IP addresses, user-agent strings, device names, or session tokens in those payloads exposes that data to all channel members — not just the server. This violates GDPR Article 5(1)(c) (data minimisation) and CWE-359 (Exposure of Private Personal Information to an Unauthorized Actor). A chat participant should not be able to infer another user's device, IP range, or session identifier simply by opening the developer console.

Construct presence update payloads explicitly, including only userId, status, and optionally lastActivity. Never spread the socket handshake object into the payload.

// WRONG — leaks IP and device fingerprint to all peers
io.emit('presence_update', {
  userId: socket.userId,
  ip: socket.handshake.address,
  device: socket.handshake.headers['user-agent'],
  sessionId: socket.handshake.sessionID,
});

// CORRECT — safe minimal payload
io.emit('presence_update', {
  userId: socket.userId,
  status: 'online',
  lastActivity: Date.now(),
});

Review every field before adding it to a broadcast payload — if it isn't required for the recipient to render presence, exclude it.