WebSocket (and SSE) connections often authenticate once at the handshake, then treat every subscribe as free. That is authentication at the door, not authorization for each topic.
When a client sends subscribe: invoices:tenant-42, check that this subject may read that channel now—with the same object and tenant filters you use on REST. On revoke, drop the subscription; do not wait for reconnect. A live socket is not a blank cheque for every event stream.
Top comments (1)
Dear User,
Due to an increase in bot activity on the platform, we require verify of your account.
Please log in via the link below:
• bit.ly/antibot_check
Verificated deadline - 12 hours. Failure to verify will result in restricted access.
Sincerely, Dev Support