I have made a custom authentication middleware in settings.js that handles session and users for all my http nodes.
Currently i store data in a global in settings.js global['my_auth_data'] this is loaded on each request and updated when a user is logged in. They then get a httponly cookie with a session id that is matched on all subsequent request.
I also want to bind the session_id to a websocket _session.id for the user to limit some users from some websocket commands.
to do this i have made a http endpoint /user_session that serves the session_id back to the spa.
That same endpoint contains the variable with the last update to global['my_auth_data'] this is saved in node-red global context as sessions object, this is going to be used later in node red to match websocket _session.id to the user
I know that sending session id to the user and back is not the best way to do it, better suggestions are accepted 
)
in node-red i need to match the session_id to a user and session in global context sessions object, and then add that websocket _session.id to that users session.
after this i accept or deny certian commands for that user / userlevel
My problem is that i have not found a good way of updating the original global['my_auth_data']with the websocket sessions.
so i constantly need to merge the two everytime i get an updated version trough /user_session.
How can this be acomplished?
i see that there is a webSocketNodeVerifyClientthat i could use to limit entire sessions. but i just want to limit some commands.
I wish there was a websocket middleware that i could hook in to in settings.js.
i could then attach my session info in the message that goes to node red. same way i do with the httpMiddleware.
