Why do we need a sessionID?

[Gua-naiko-che]

This is a question about an implementation detail in the documentation examples.

Here it says

On the server-side (server/index.js), we create two random values:

• a session ID, private, which will be used to authenticate the user upon reconnection
• a user ID, public, which will be used as an identifier to exchange messages

Why do we need a session ID different from the user ID? Wouldn't it be enough just to use a server-generated user ID for both message exchanging identifier and for identifying the user upon reconnection?

[darrachequesne]

Hi! That's because the session ID must be kept private, else anyone could authenticate as a given user (since the user IDs are shared to all the other users).