Best strategy to share some sensitive user data between Node and PHP

Question

I am creating a website that is built on PHP. It has a small page where users can have a group chat and message each other. For that page I open a websocket with a help of socket.io and expressjs. I want to use usernames that people registered with. And, of course, I want people not be able to impersonate other people. So, once user enters a message, it gets socket.emited to the server, and from the server I do something like:

socket.on('message', function(msg) {
    io.emit('message', {
        username: username
        message: msg
    });
});

To broadcast that message to everyone.

My question is, how do I retrieve the username? My solution at the moment is this. I create a unique 128 chars long user_id on user sign up, store in redis something like

user_id: username,

and then I pass user_id on socket.emit and do on Node server

username: redisClient.get("user_id").

Is it a good idea? Is it secure? Or there are better solutions to this problem?

Answer 1

From my perspective your case fits very well with JSON Web Token (JWT) approach. You can encode all necessary data in JWT and pass it with requests. Your Node.js application should verify signature of JWT and extract all needed data from it. If something is too big / complex to put in JWT, than backend application may request for this data another backend service for it via your backend network security mechanisms.