I want to know if it's dangerous in any way to store the current logged user session id on the page generated source code.
Why I wanted to do that?
I'm trying to share the user session between two applications, one (the main) in PHP and another in Node.js. The Node.js one is used just for real-time data, but I just want to send live data to logged in users in the PHP application.
As the session ids are stored in a Redis instance accessible for both PHP and Node, I can just send the session id from the client to the Node.js (using websockets messaging).
Why not use the cookies already present in the user browser?
The Node application is served using a different host. So the cookie is not going to be available.
/php
, and/node_js
. So you can still use the Secure and HTTPOnly cookie directives, and have a secure session handler.