Q:

Secure Flask-SocketIO communication with basic authentication

I have a Flask-SocketIO application that is authenticated with basic auth. I am trying to ensure that all my socketio communication is protected as well, at least to the same degree as basic auth.
From Flask-SocketIO's documentation on authentication:

However, in most cases it is more convenient to perform the traditional authentication process before the SocketIO connection is established. The user’s identity can then be recorded in the user session or in a cookie, and later when the SocketIO connection is established that information will be accessible to SocketIO event handlers.

Thus I'm trying to figure out how to store something secure with the user session. Let's say I do the following, first for login, I signed the hashed username and password:
from flask import session
from itsdangerous import Signer

signer = Signer('super secret key')
def login(username: str, password: str):
    if (username, password) in credentials:
        hashed = hash(username + password)
        session['user'] = s.sign(hashed)

Then I can make a decorator for my socketio listeners that simply checks that the signed value in the session is valid:
def authenticated_only(f):
    @functools.wraps(f)
    def wrapped(*args, **kwargs):
        try:
            signer.unsign(session['user'])
            return f(*args, **kwargs)
        except BadSignature:
            disconnect()
    return wrapped

@socketio.on('my event')
@authenticated_only
def handle_my_custom_event(data):
    pass

Is this a reasonable approach? Are there pitfalls I am missing? Is this pointless because I'm using basic auth?

A:

Socket.IO uses a permanent connection with each client, so really there is only a need to authenticate the connect event. If the user is invalid, you return False from this event and the connection will not be accepted. In any other cases, the connection is authenticated and there is no need to verify the user again every time they emit an event.
Since there is a need to authenticate the user only once, I tend to not write a decorator for this, I just add the verification logic directly in the connect event handler.

