…is safe or can people forge…
Like the accepted answer already stated: If you implemented it well and if there is no MITM (which can be handled by using HTTPS), then it is rather difficult to forge the RSA signatures.
As (rather lengthly) aside, I’ld like to point to a few things that are worth considering:
Comments (1, 2) by CodesInChaos:
Are you using HTTPS? Without HTTPS a webapplication has no hope of being secure. … It still matters if your website was loaded over SSL (i.e. uses HTTPS) and if the web sockets run over SSL.
Comment (1) by Hunter:
Comments (1, 2) by dlongley:
Keep in mind that server has complete access to the users' private keys in the system you describe (and they should know that if it may affect their privacy). … if the private key can be accessed via JS, then the server can access it (and could, for example, send it to the server). The user must trust that the server won't do so, but it is technically possible. Users should know this if it affects their privacy (they shouldn't export and use the private keys in other systems, for instance).
Answer (1) by Ninveh:
… and we don't know how well the guy who wrote and modified the code behaved. Some critical security routines there were modified by him, and this should ring a big red alarm bell over its usage. If you plan to use it for anything important, you need to pass the published code through a critical security/cryptographic review before usage.
Comment (1) by C1D – the person that asked the question:
The client stores the private key not the server. My protocol will provide an official open source client but theoretically if a user enters his password into a rouge client it could steal it.
TL;DR – The term “safe” is a bit relative in the questioned scenario.