I currently ran into the problem of handling the authentification of a user on the server, using **Laravel** and **RachetPHP**. 

What I tried so far:
--------------------

* I changed the driver type of the session to database, giving me an id and payload column. Using `\Session::getId()` returns a 40 character string. 
The cookie information, sent by the WebSocket-Connection does contain a XSRF-TOKEN and a laravel\_session, both containing > 200 characters string. The database ID of the users session differs from the id, returned by `\Session::getId()`.
* I am already sending the current CSRF-token via the websocket message, but I have no clue how to verify it (the built-in verifier uses requests - which I don't have in the websocket server scope).

Generic Use case:
-----------------

A User posts a comment in thread. The payload of the sent object would then be: 

* Something to verify the user (an ID or a token).
* The comment itself

If you were to send the user ID, anyone could temper the packet and send the message under another ones user.

My use case:
------------

A user can have *n*-characters. A character has an avatar, an id, a name, etc.
The user is only used to:

* authenticate at the server.
* access his characters, and thus perform basic CRUD operations on his characters.

I also have a table **locations** - a "virtual place", a character can be in... so I got a one-to-one relationship between **character** and **location**. The user (character) can then send messages in a location via websocket. The message is inserted at the database on the server. At this point, I need to know:

* If the user is authenticated (csrf-token ?)
* If the user is the owner of the character (it's very simple to spoof the request with another user's character id)

If you need more information, please let me know.