I have a php and nodejs server. User logs in on the php backend, and, when entering nodejs, the php SID cookie is being passed through a websocket. I further take the session ID, find the session file in php's directory and deserialize it, where I can access data.
Is that safe? The websocket does not use a TLS connection. If not(probably) why, and what are the threats?