@pwFoo I'm not sure I understand which forum was which in your reply. I think what you're asking is there is an API call in nodebb to validate a user, which there is, @ /api/login. It taks a POST with username/password/_csrf as the body variables (in json). If you're doing this cross site though, you'll need to accomplish the task of generating a csrf token. You can do this by making a GET to /api/login, which gives you a csrf token, make sure to then send the following login POST using that csrf token + the express_sid session cookie (session is tied to csrf token).

Hope that makes sense, or helps you at all. You could created a nodebb plguin that uses some express midlleware that would accomplish all of the above seamlessly. It's best to do in in the plugin where you can customize CORS and other settings on your endpoints for cross domain use.

Yes, the polling 200 status indicates nothing is wrong. Everything you're seeing is completely normal of nodes Socket.IO.

Furthermore, polls are done on port 80 http, so it would never be blocked. Webscoket traffic in general is done ona range of ports, none of which ISP's filter (I've worked for an ISP). The only port I know that SOME NorthAmerican ISP's block is SMPT incoming and even that is rare.

PwFoo, your use case is no different than any other multi-application integration. Any site would have to deal with shared user sessions. This is not PHP though, this is Node/Express, and there is no PHP session ("login") for you to share.

The way I went about doing what you want, is exporting all wordpress users, importing them into nodebb with a custom nodebb-plguin, and also creating a custom login endpoint in my plugin that not only sets the current nodebb session, but sets an additional header to create the wordpress session cookie for the global domain. Wordpress sits on blog.mysite.com and nodebb at forum.mysite.com. That extra cookie is than shared. You could then set the PHP session by doing something useful with that cookie. In my case, both NODEBB and other apps on my site share the same custom session storage with MongoDB. One app can read the cookie that nodebb uses, and open the same session over Mongo, thereby sharing user data/state accross applications.