In a client-server communication scenario over secure websocket, client is authorized securely and from there on, I have two choices:
- Assign a unique random ID (session) and check that on subsequent communications.
- rely on socket connectivity and keep a handle to the socket object (which internally use it's own session).
For sure the first choice is secure if has been implemented properly. My question is, if the second one is secure. If someone be able to intercept websocket connection in such a way that connection is not dropped, this choice could not be considered secure. Should I worry about that?