Funny anecdote from using Socket.io for the first time several years ago. Some friends and I were building a fairly standard CRUD webapp, and we misunderstood some Socket.io documentation, thinking it handled the session separation under the covers. Instead, when we tried it on a shared server instead of locally, we discovered that any UI action was sent to all users of the site. There was effectively one session that all users shared. We pivoted to a 'Lightweight Collaborative Web Browsing Experience', but couldn't get it working reliably.