websocket-socketio-patterns

Validate the JWT in a Socket.IO middleware during the handshake, before the connection is established. Parse the token from cookies or handshake.auth, verify it with jsonwebtoken, attach the user to socket.data, and call next() with an error to reject unauthenticated clients.

Track a per-user socket count in a Map or Redis Set rather than relying on a single disconnect event. Broadcast online status only when the first socket connects, and offline status only when the count reaches zero, so users with multiple tabs stay online.

Join each user to a personal room named user:${userId} when they connect. Then emit to that room with io.to(`user:${userId}`) to reach all of the user's active devices without tracking individual socket IDs.

Initializing io() directly inside a component body creates a new connection on every re-render. Store the socket in a module-level singleton or ref, create it lazily with autoConnect: false, and manage connect/disconnect inside useEffect.

Yes, attach @socket.io/redis-adapter or @socket.io/redis-streams-adapter so events broadcast on one node reach clients connected to other nodes. This is required whenever running more than one backend instance or cluster.

Use acknowledgement callbacks: the client passes a callback function with the emit, and the server invokes it after persisting the message. Return { status: "ok", data } on success or { status: "error", message } on failure so the client can reconcile optimistic UI.