title: socket.io authentication after socket established
body: <p>I'm working on a small multiplayer game. I'd like to introduce authentication. I'm using Node.js and Socket.io.</p>
  
  <p>When the user arrives that the main page - I want them to join the game whether they are logged in or not - but they will be unable to do anything within it (only watch).</p>
  
  <p>How could I then go about authenticating the user on the already open socket?</p>
  
  <p>Could I maintain the authentication still if they left the site and came back? Can you pass a cookie through a web socket?</p>
  
  <p><strong>EDIT</strong></p>
  
  <p>To further my question. One of the possible thoughts I've had is to provide the websocket connection, then when they try to login in, it passes username and password as a message to the websocket.</p>
  
  <pre><code>client.on('onLogin', loginfunction);
  </code></pre>
  
  <p>I could then take the username and password, check against the database, then take the session ID of the socket and pass it somewhere to say that session is authenticated to that user.</p>
  
  <p>Is this secure? Could I still implement a cookie on the socket so they could come back? Is there any way within socket.io of stating that the socket is now authenticated instead of manually checking on each message received?</p>
  
  <p>Cheers</p>