> ... because you cannot attach an Authorization: Bearer header to a websocket.
Well, not properly. You can abuse the Sec-Websocket-Protocol header to pass an initial token to the server.
Well, not properly. You can abuse the Sec-Websocket-Protocol header to pass an initial token to the server.