title: PHP + socket.io (session, authorizing and security problems)
body: <p>I have a working php application in which I want to add real-time support. I would like to use nodejs/socket.io to add that kind of functionality. 
  <br/><br/>
  First problem I found was how to properly authorize user on nodejs side (user is already authenticated on php backend through PHP session). Using <strong>socket.handshake.header.cookie</strong> on nodejs side i can parse and get PHP session id, which I can authenticate through redis/memcache/database (depending on what have I used to save session information).<br/> Everything looks cool when user has only one tab/window of the site opened - when having more and using <strong>session_regenerate_id()</strong>, in nodejs the user authenticates with another sessionid key, so I cannot distinguish two tabs by anything other than the socket id they connected with. When user logouts he shouldn't be getting any messages on any tab (because he already logged out on every tab/window from that browser). So on logout message (sent from browser just before the logout PHP things) I should remove all the socket connections connected to the authorized user id. But what if user logges in on two devices (fe. pc browser and an ipad safaris). After logout on one device, he shouldn't be getting any messages on the device he logged out, not on every device. <strong>How can i distinguish connections from different devices/browsers in socket.io?</strong> Of course not using <strong>session_regenerate_id()</strong> would be efficent here, but what can I do if I really want to use this feature?
  <br/><br/>
  Another problem I have is rather a security issue (or even question). Let's assume that authorized user in application can see page <strong>example.com/user1</strong> (which is a news feed for user1) and cannot see <strong>example.com/user2</strong> (fe. he doesn't have rights to see it). I'd like socket.io to send update messages to browser when user is on <strong>example.com/user1</strong>, and of course not to send when user is on <strong>example.com/user2</strong> site. On socket.io side I can read the referer address (so presumably, when user is on user2 site he does not get any socket.io connection). The question is: <strong>should I compare the referer address with the rights of authenticated user on node.js side? Or maybe the referer value is <em>safe</em> on the node.js side?</strong> Adding another db check on node.js side would slow it down (because almost every request there should be same database check on two sides - PHP and node.js).
  <br/><br/>
  Or maybe the whole concept of socket.io + PHP application working the way I presented is wrong? </p>
  
  <p><strong>UPDATE</strong>
  <br/><br/>
  I think I found a way to omit problems with the first question - basically I just add another cookie (besides PHPSESSID) fe. named NODESESSID, which I generate (fe. using uniqid()) when user is authorized. Now authorization on node.js side is comparing PHPSESSID and NODESESSID (both must match). Now, when user logges out he delivers the message <em>logout</em> to socket.io and socket.io disconnects all the sockets with NODESESSID. This is like connecting the benefits of regenerating session id and not regenerating session id (but is not vulnerable to session fixation, isn't it?). </p>