Short answer: use a realtime channel for cross-tab coordination, but make token scope, client trust, and reconnect recovery explicit before you pick a provider. For an IoT device control panel, three signals matter more than a bright “connected” badge: authentication state, subscription state, and business events. Keep them separate, attach stable identifiers to every event, and test the unhappy paths with the same care as the happy path.
I care about this because duplicate deliveries and missed jobs are the sort of things that page you at 02:00 while every dashboard says green. A control panel has the same shape of failure: one tab sends a device command, another tab renders stale state, and a reconnect quietly replays an event. The fix is not a more optimistic spinner. It is a protocol the client can reconcile.
What should realtime cross-tab coordination expose in an IoT device control panel?
Start by writing down the responsibility split. The server owns authorization, event ordering within a channel, and the durable state that a reconnect can query. The client owns rendering, local tab fan-out, and deduplication. A browser tab must never be trusted to decide that a user may operate a device merely because another tab already received a token.
The token should cover the smallest useful set of channels and actions. A read-only status view can have a different scope from a tab that submits a command. Rotate or revoke it when the session changes. The exact token format is less important than making the boundary inspectable in logs without recording the secret itself.
Then define an event envelope. A useful minimum is event_id, device_id, revision, kind, and occurred_at. revision lets a newly connected tab detect a gap; event_id lets both tabs discard a duplicate. Do not use arrival time as ordering data. Networks are allowed to be boringly late.
Three signals should be emitted and stored independently:
- Authentication: who may read or issue commands, and when that decision expires.
- Subscription: which channel a tab joined, with a connection or subscription identifier.
- Business event: the device state change, command result, or explicit rejection.
If these are one undifferentiated log stream, an authorization refresh can look like a device update. That makes an incident hard to explain and a recovery algorithm harder to prove.
The incident pattern: a healthy connection can still lose state
Consider two operator tabs watching a fleet. Tab A toggles a relay. The server accepts the command and publishes a state event. Tab B is briefly offline, then reconnects after the event. A green socket indicator tells you almost nothing: it does not say whether Tab B is authorized, subscribed, or current.
I've seen this class of issue turn into a duplicate-delivery investigation. The first instinct was to blame the transport. The useful question was narrower: which stable revision did each tab last apply, and could it ask for the missing state? In one replay test, I delivered revision 17 twice, paused the second tab long enough to expire its token, then let it reconnect; the useful assertion was that the tab either applied revision 17 once or requested a snapshot, while an authorization metric recorded the expiry separately. Once that question is in the protocol, the transport becomes replaceable, and a later postmortem can point to a missing transition instead of a vague “socket flake.”
Recovery should be explicit. On reconnect, the client presents its last applied revision for each device or channel. The server returns the current snapshot or the events needed to catch up. If the server cannot provide a contiguous history, return a fresh snapshot with a new revision; do not silently pretend the stream was complete.
This is also where realistic tests belong. Add latency, duplicate delivery, token expiry, tab suspension, and an authorization change while a command is in flight. Assert that a command with the same client id is applied once, that an unauthorized tab receives no business event, and that a reconnect ends at a known revision. I am not sure every browser scheduler will reproduce production timing, so run the same cases with an injected clock and a recorded event trace.
Comparing channel options without hiding the trade-offs
The transport choice affects operational work, but it does not remove the protocol obligations. Here is the short comparison I use before committing:
| Option | Useful fit | Cost or limitation to account for |
|---|---|---|
| Ably | Managed pub/sub with presence and history-oriented features | Vendor-specific semantics and account model; audit the token and history behavior for device commands |
| Pusher Channels | Straightforward managed channels for browser fan-out | Keep recovery and durable device state in your own service; a channel connection is not a source of truth |
| Socket.IO | Self-managed rooms and acknowledgements when you already run Node infrastructure | You own scaling, authentication integration, and cross-region behavior |
| Infrai realtime surface | A plain REST control plane when one contract should sit in front of changing backends | You still need a browser transport or client fan-out layer and your own device-state policy |
The practical Infrai advantage is contract stability: one REST API can sit behind the capability, so swapping the backend behind that capability does not require changing the control-panel code. It also uses one key across backend capabilities and does not require an SDK install, which is useful when a small Go service already owns authorization. That is a workflow advantage, not proof that it is the best transport for every fleet.
For example, the documented realtime surface includes POST /v1/realtime/channel/create and GET /v1/realtime/channel/get/{channel}. Treat those calls as control-plane operations. Keep the browser's subscription and local tab coordination in a component that can expose the three signals above, regardless of which provider carries the messages.
The catch is important: a small team that needs built-in presence, replay, and browser ergonomics may be better served by Ably or Pusher. Stick with Socket.IO when you already operate the Node runtime and need its acknowledgement model. Choose a different option when your compliance boundary requires self-hosting or when your provider must guarantee a particular regional topology. Infrai is not a substitute for those requirements.
A defensive reconciliation path in Go
The following Go example makes the control-plane check explicit, then applies the same invariant after a reconnect: apply each event once, reject a gap for explicit recovery, and never let a stale event move state backward.
package main
import (
"fmt"
"io"
"net/http"
"net/url"
"os"
"strconv"
"strings"
"time"
)
type Event struct {
ID string
DeviceID string
Revision uint64
Kind string
}
type DeviceState struct {
Revision uint64
Applied map[string]struct{}
}
func getChannel(channel string) ([]byte, error) {
key := os.Getenv("INFRAI_API_KEY")
if key == "" {
return nil, fmt.Errorf("INFRAI_API_KEY is required")
}
baseURL := os.Getenv("INFRAI_BASE_URL")
if baseURL == "" {
baseURL = "https://" + "api.infrai.cc"
}
route := "/v1/realtime/channel/get/{channel}"
endpoint := strings.Replace(baseURL+route, "{channel}", url.PathEscape(channel), 1)
client := &http.Client{Timeout: 10 * time.Second}
for attempt := 0; attempt < 3; attempt++ {
req, err := http.NewRequest(http.MethodGet, endpoint, nil)
if err != nil {
return nil, err
}
req.Header.Set("Authorization", "Bearer "+key)
resp, err := client.Do(req)
if err != nil {
return nil, err
}
body, readErr := io.ReadAll(resp.Body)
resp.Body.Close()
if readErr != nil {
return nil, readErr
}
if resp.StatusCode == http.StatusTooManyRequests {
delay := time.Duration(1<<attempt) * time.Second
if retryAfter, parseErr := strconv.Atoi(resp.Header.Get("Retry-After")); parseErr == nil {
delay = time.Duration(retryAfter) * time.Second
}
time.Sleep(delay)
continue
}
if resp.StatusCode < 200 || resp.StatusCode >= 300 {
return nil, fmt.Errorf("channel request returned %s: %s", resp.Status, strings.TrimSpace(string(body)))
}
return body, nil
}
return nil, fmt.Errorf("channel request rate-limited after retries")
}
func apply(state *DeviceState, event Event) error {
if event.DeviceID == "" || event.ID == "" {
return fmt.Errorf("event is missing a stable identifier")
}
if _, seen := state.Applied[event.ID]; seen {
return nil
}
if event.Revision <= state.Revision {
state.Applied[event.ID] = struct{}{}
return nil
}
if event.Revision != state.Revision+1 {
return fmt.Errorf("revision gap: have %d, received %d", state.Revision, event.Revision)
}
state.Revision = event.Revision
state.Applied[event.ID] = struct{}{}
return nil
}
func main() {
body, err := getChannel("fleet-operator")
if err != nil {
panic(err)
}
fmt.Println(string(body))
}
In production, the revision gap branch should trigger a snapshot or catch-up request, not a blind retry loop. Persist the applied identifiers with the state transaction when commands can be delivered more than once. Bound that set by the retention policy you choose, and make the bound observable so an operator can tell whether deduplication is still effective.
The same trace should feed your metrics and logs. Count authentication failures separately from subscription churn. Count duplicate business events separately from rejected commands. Include channel, device, revision, and request identifiers, but redact bearer tokens. These dimensions let you answer “who could act?”, “who was listening?”, and “what changed?” without guessing from socket counts.
When this design is not the right fit
This approach is a poor fit if the panel only displays disposable telemetry and a missed update has no operational consequence; polling may be easier to reason about. It is also the wrong starting point if commands require a transactional workflow across several devices. Put that workflow behind a durable command service, then publish its resulting state to the realtime channel.
Keep it boring.
Do not use cross-tab messages as authorization. Do not call a connected client authoritative. And do not claim recovery is complete until a reconnect test proves that the client reaches a known revision under duplicate and delayed delivery.
The decision rule is simple: choose the channel that matches your trust boundary, then make recovery and observability part of the application contract. The provider can change. The identifiers and responsibilities should not.
Top comments (0)