A WebSocket reconnect is not a free pass

A long-lived WebSocket often authenticates once at connect time. That is necessary, not sufficient. On reconnect, after a resume token, or when the client re-subscribes to a channel, re-check authorization against current membership and roles. People get offboarded, plans change, and channel grants expire while sockets stay "alive" in clients'... Weiterlesen