Centrifugo title matches point to a real-time server with an optional admin plane
Centrifugo title matches point to a real-time server with an optional admin plane Centrifugo is a self-hosted real-time messaging server that supports WebSocket, Server-Sent Events, HTTP streaming, WebTransport, and gR
Centrifugo title matches point to a real-time server with an optional admin plane
Centrifugo is a self-hosted real-time messaging server that supports WebSocket, Server-Sent Events, HTTP streaming, WebTransport, and gRPC. A public page carrying its name can be a client integration, a documentation page, or an administrative interface. The identity and API boundaries determine which one matters.
A count-only ZoomEye probe on November 15, 2026 used sub_type=all, page 1, and page size 1. app="Centrifugo" returned 0, title="Centrifugo" returned 7,143, and http.body="Centrifugo" returned 8,599. The title count is substantial, but it does not prove that every match is a running server or that the admin UI is enabled.
Separate client, admin, and API paths
The Centrifugo admin web UI is optional. When enabled, it can be protected by an admin password, an admin token, or SSO in the PRO edition. The documentation explicitly describes an insecure mode that requires no authentication for the web interface or admin API. The server HTTP API can also use an X-API-Key header.
Inventory each path independently. The client endpoint accepts subscriptions and publishes application events. The admin endpoint can change server state. The API endpoint can publish messages, disconnect users, or force subscriptions if the caller has the right key. A client-facing page should not inherit the admin credential.
Store the admin password or API key outside the web root and rotate it after any exposure. Use a unique token audience and issuer when SSO is enabled. Do not accept an access token that was issued for another application. Check that the admin UI is reachable only from the operations network or an identity-aware proxy.
Treat channels and history as application data
Centrifugo can carry presence information, history, and user-specific channels. The exact retention behavior depends on configuration and edition. Identify whether history is stored, which backend holds it, and who can query presence. Channel names can disclose application structure even when message contents are encrypted at the transport layer.
Review client token claims. A token that is valid for one user should not authorize a channel namespace owned by another tenant. The channels claim may be misunderstood as a complete permission list, so document the intended authorization model rather than relying on an operator's reading of one field.
Validate the matches
For each title or body match, verify the endpoint and owner with a permitted request. Record the server version, transport, TLS state, admin exposure, authentication mode, and API key owner. Do not publish messages or enumerate channel data on a host you do not own.
The zero application count is a useful caution. Product-name pages are not the same as server fingerprints. Use the title and body counts to find candidates, then confirm service behavior and authorization before calling the result a deployment.
What to review after confirmation
Confirm that public clients connect to a client-only path, operators use a separately protected admin path, and server-to-server callers use a scoped API key. Check logs for admin token leakage in URLs. The Centrifugo security advisory GHSA-v4h4-9j4c-ghgp documents exactly that class of token exposure, which makes URL hygiene part of the admin review.
The count is a lead. The lasting control is the separation between the message plane, the admin plane, and the credential that can act on both.
References
Originally published by Dev.to Security. Aggregated on AIWithGhost for educational purposes — full credit and traffic to the original publisher.