title: PHP and node.js shared session identification
body: <p>I'm looking at implementing a chat/messaging system using node.js and socket.io to pass messages etc.</p>
  
  <p>However the system will use a php authentication system using PHP sessions. Obviously I need some way of knowing that the connected node.js user X is the PHP-authenticated user X?</p>
  
  <p>After a bit of research, it seems it is fairly common to use Memcache to share php sessions with node (by storing in JSON etc). However there is still the problem of identifying which connected node user is which stored php session?</p>
  
  <p>My first thought was to use the cookie that PHP sets, utilising the PHPSESSID value etc-  however surely a user could modify that cookie to someone else's PHPSESSID, and bazinga? (Obviously they'd either have to know that PHPSESSID or be very good at guessing, but this still appears to be a security hole?</p>
  
  <p>What are your thoughts on this? Is the best way to achieve what I want?</p>