title: Safe authentication with node.js and session.socket.io?
body: <p>I'm using the latest versions of node.js and <a href="https://npmjs.org/package/session.socket.io" rel="nofollow noreferrer">session.socket.io</a> and this is how I set the session (please note that I'm not using a HTTPS connection so no <code>secure: true</code>):</p>
  
  <pre><code>app.configure(function() {
      app.use(cookieParser);
      app.use(express.session({
          signed: true,
          store: sessionStore,
          secret: 'SECRET',
          cookie: {
              maxAge: 24 * 60 * 60 * 1000,
              httpOnly: true
          }
      }));
  });
  var sessionSockets = new SessionSockets(io, sessionStore, cookieParser);
  
  // Later
  sessionSockets.on('connection', function(error, socket, session) {
      // session could be used here to detect if user is logged in
  
      // e.g. login: session.name = 'x'; session.save();
      // e.g. checkIfLoggedIn: if (session.name) return true;
  });
  </code></pre>
  
  <p>Is my code safe/correct or how I could authenticate that a user is really logged in?
  Is it possible/recommended to change the <code>sid</code> of the cookie on the clients (due it's mentioned <a href="https://stackoverflow.com/a/11585839/1814346">here</a>)?</p>