Channel authorization re-validated on subscribe, not only at initial handshake

A handshake-only authorization model is susceptible to time-of-check/time-of-use attacks: a user whose channel access is revoked after connecting can continue subscribing to restricted channels until the connection drops. CWE-285 (Improper Authorization) and OWASP A01 (Broken Access Control) both describe this failure — authorization decisions must be re-evaluated at the point of access, not cached from an earlier check. In a community app, this means a banned user or a user whose subscription lapses can still join private channels by issuing subscribe events on an existing connection.

Re-check channel permissions on every subscribe event, not only at connection time. Emit an error and skip socket.join() if the check fails.

socket.on('subscribe', async (channel: string) => {
  const allowed = await checkChannelAccess(socket.userId, channel);
  if (!allowed) {
    socket.emit('error', { code: 403, message: 'Forbidden', channel });
    return;
  }
  socket.join(channel);
  socket.emit('subscribed', { channel });
});

Never trust client-side authorization state. The server must be the sole authority on channel membership.