So I have a PHP server that runs a website, and the website has features such as live notifications, which are basically notifications that get sent to you once a user likes or comments on one of your posts, live.

I decided to use WebSocket for this, just for practice. So to use WebSocket, I need to authenticate the user and use his information in order to get and deliver data to other connected users.

Stage one

I know that PHP gets the session id of the logged in user from the cookies, and uses that ID to retrieve his session file, which holds his user id.

I thought of saving the session id in a database, linked to the user id, and then when the websocket connection initializes, I send the cookie session id and then the websocket server checks the sent ID from the database.

Stage two

If you like or comment on a post, you need some kind of a service that handles it, whether if you can like or comment, and what it does when you try to do that, and in my opinion that logic should be done on the web server, on the PHP project.

So what I thought of doing is first sending an XMLHttpRequest when you like or comment on a post, and that request returns status, if it succeed or failed. If it succeed, then the response will contain the ID of the post or like, and it will be sent over to the websocket server, and the server will notify all users after verifying that it's real.

Now the question is, can you find any flaws in one of these stages? Am I thinking the right way?