I am using Lucia auth in combination with nextjs and an additional Express server that hosts a socket.io connection for real-time chat. My application is fully protected and is mostly server-side up until the point where the user enters a chat room. I've even protected the database fetching so that no random user can fetch a conversation they're not apart of however I'm really struggling with protecting the socket.io server from a potentially malicious user sending a message in an unauthorized conversation. The reason for this is because to connect to my socket.io server the component that connects to it needs to be a client component. So Lucia uses a database session for authentication and the session id is stored in the cookie. What I'm doing right now is sending the cookie value from a parent server component to the socket io client component via props and it's sending the cookie value to the express/socket io server. Then on the socket io server the cookie value is being checked against the database and if the session exists and it corresponds to one of the users in the conversation the user can connect to the socket. I genuinely don't know how else I'd get that value and I'm wondering since the cookie value containing the session being exposed on the client side is bad and if it is what I can do to fix that?