My application uses Laravel/Fortify package, guarded by web/session/memcached. I want to add golang-powered websocket server in my app. And I need to authorize users. As I understand I can use cookies saved by Laravel. This is decrypted cookies (I think I can decrypt it in golang module with env:APP_KEY)
So, in golang I decrypt cookies, read from memcached session record, check xsrf_token and I have <user_id> by key login_web_<[0-9a-f]+>? What mean hex numbers after 'login_web_'? Do I need to check it to use authorization correctly and safely?
I was able to verify the user this way. I'm use code from vendor\laravel\framework\src\Illuminate\Encryption\Encrypter.phpdecrypt to decrypt Laravel's cookies and vendor\laravel\framework\src\Illuminate\Cookie\CookieValuePrefix.php to process cookie prefix.