A simpler solution is to simply keep the connection open until the session is complete. That way you can use the long-lived session token (in the cookie) each

A simpler solution is to simply keep the connection open until the session is complete. That way you can use the long-lived session token (in the cookie) each time the user visits your site/app and then just keep a WebSocket open while the user is connected. This has many advantages beyond the short/love-lived cookie stuff.