WebSocket connections require authentication before streaming

An unauthenticated WebSocket endpoint is an open data tap. Any client — including malicious actors scanning for open sockets — can connect and receive the full message stream without possessing a valid session. OWASP A07 (Identification & Authentication Failures) and CWE-287 both flag authentication bypasses as severe because they eliminate every downstream access control you've built. In a community platform this means private channel conversations, direct messages, and presence events are exposed to anonymous consumers the moment the server boots.

Add a Socket.IO middleware that validates the bearer token on the handshake before the connection is established. Reject with an error — never open the stream first and check later.

io.use((socket, next) => {
  const token = socket.handshake.auth.token;
  if (!token) return next(new Error('Missing authentication token'));
  try {
    socket.userId = verifyToken(token).id;
    next();
  } catch {
    next(new Error('Invalid token'));
  }
});

For SSE endpoints, validate the session cookie or Authorization header in your HTTP route handler before writing the Content-Type: text/event-stream response header.