WebSocket questions about client legitimacy

Recently engaged in a websocket project, because the first time, a lot of things do not understand, so want to ask a question, is: If a lot of clients link up, then how can I verify the legitimacy of this client? I looked at the handshake protocol part, as if I could not do anything. Ask God for guidance, thank you.

Reply content:

Recently engaged in a websocket project, because the first time, a lot of things do not understand, so want to ask a question, is: If a lot of clients link up, then how can I verify the legitimacy of this client? I looked at the handshake protocol part, as if I could not do anything. Ask God for guidance, thank you.

I didn't do it, I could do it like this:
1. When creating a socket connection, it is required to send the identity cookie information of the current site, such as PHPSESSID.
2, if the user is logged in, the Web server will record the user's session (such as the database or cache), the socket server go to the same place to verify the existence of the session, or call the interface mode.

The user's sessionidsend to the server, the server based on the SessionID to disk or storage to read session data, we know whether the user is logged in, who is

