Handle variables from multiple login for real-time chat - node.js

Question

I'm writing a nodejs server that combine a login function and real-time chat. The problem came when I try to get all the users that logged in and connected with my real-time chat server then return to the client (so they can choose a specific user to chat with).
This is my code for log in function. I declared a variable so when client request the /doLogin, the username will be stored in it
var userLogged = {name: null, socketid: null};
app.post('/doLogin', function(req,res){
db.users.findOne({username: req.body.username}, function(err, user) {
if( err ) {
console.log("Login fail");
}
else if (user != null) {
if (req.body.password == user.password) {
req.session.user_role = "user";
userLogged.name = req.body.username;
} else {
req.session.user_role = "null";
}
}
res.send({redirect: "/"});
});
});
And in real-time chat function (using Socket.io), when user connect (after logged in), I will store the socket.id into the variable before, and save that variable in mongodb.
io.sockets.on('connection', function(socket){
var address = socket.handshake.address;
userLogged.socketid = socket.id;
db.clientList.save({name: userLogged.name, socketid: userLogged.socketid}, function(err, saved){
});
console.log("Connection " + address.address + " accepted.");
//
//
socket.on('disconnect', function(){
db.clientList.remove({socketid: userLogged.socketid});
});
});
And the problem is, when other users log in, the variable change so I cannot save the right information in to database.
Please help me!

Answer 1

socket.io allow you to read cookies:
// app.js
io = io.listen(server);
io.set('authorization', function (handshakeData, accept) {
handshakeData.cookie = cookie.parse(handshakeData.headers.cookie);
});
the right way to do is:
cookies --> sessionID --> user --> username
document: http://howtonode.org/socket-io-auth
More simple:
if security is not important to you, you can set username to cookie, then you read username in easily in server: cookies->username
// login handler
res.cookie('username', username)
res.send({redirect: "/"});
// io connection handler
io = io.listen(server);
io.set('authorization', function (handshakeData, accept) {
console.log(handshakeData.headers.cookie)
}
note that, any web user can change their own cookie to fake your name, so this is for test, you should NOT use this for production.