How to make friends Ratchet WebSocket server and $_SESSION and is it worth it at all?

Question

PHP

I am developing a website. When entering / registering, the necessary information about the user is written to the $_SESSION variable. When some AJAX request occurs, for example, editing a profile, the server always checks $_SESSION to understand whether this user can edit this profile at all or not and whether the user is authorized at all.
I am developing a chat. Let's say the following information comes to the server:

{
user_from_id: 1,
user_to_id: 2,
message: 'Привет!',
}

How to be? How to check that user_from_id is the user who sent the message. After all, the request is elementary to fake.
I know about the option with Symphony Session, but I don't use Symphony anywhere on the site. How to be?
Or is there some other way to check it?
I thought about the following option:
Send PHPSESSID to the server, look for a file (yes, I don’t store sessions in the database) that relates to the sent PHPSESSID and see what is there. But I feel that this is a bad decision.

Answer 1

Generate a unique key for the user during authorization - a token. Further, from the user, send a message and attach a token, check on the server whether it is valid or not.