title: How to differentiate between Symfony user roles/groups in socket.io chat
body: <p>I've been playing a bit with socket.io's chat, and I have a question: how can I differentiate between an admin user and a regular user in the chat room? I'd like the admin to have powers like kicking and banning people, but my users to not. </p>
  
  <p>I'm using Symfony to develop my application, and I'd like to use its user database for the chat users. I'm using <a href="https://github.com/FriendsOfSymfony/FOSUserBundle">FOSUserBundle</a> for my Symfony app's users. They are split into multiple groups, so I have the <code>admin</code> group, and others. </p>
  
  <p>The <code>admin</code> group has <code>ROLE_ADMIN</code> which means that each user inside it has that role. That is the admins group and each user in this group should have permissions to ban, kick, mute etc. other users in the chat room.</p>
  
  <p>For using my Symfony users in the chat, I've been reading into Redis to get their sessions, but I'm not exactly sure how to make the difference between my admin users and regular users. How can I prevent a regular user from making a request to the server that does something that the user doesn't have access to? Because anyone can do requests, but <strong>how can I validate</strong> those requests if they come from users stored in a MySQL database on the Apache server?</p>
  
  <p>If not for Symfony, how this could be done in a regular PHP application? In the end, it doesn't matter how the admin is defined, but how to connect him to the Node server and how to make the Node server work with my user database.</p>
  
  <p>I had an idea of simply encrypting and sending the user's data to the node server, then decrypt it there. Only the two servers know the private keys, so even if a client gets its hands on the encrypted data, he can't make a request with it for another client. I may do some IP check and a timestamp. The decrypted data on the node server could then be used to say if the user is an admin or not and allow him to send certain requests. Is this a good idea or is there a better way?</p>