Authorize WebSocket actions after the connection opens
Map message types to resources and current permissions. Test subscriptions, role changes, session expiry, and cross-tenant messages on an existing connection.
A successful WebSocket handshake should not freeze a user's authority for the life of the connection. A user can lose a role, leave a workspace, or sign out while the socket remains open. Decide how those changes affect messages and subscriptions before implementing a reusable connection context.
OWASP covers message-level authorization and session handling. The message matrix below focuses on application actions. It is separate from the origin and credential checks that admit the connection.
Map messages to protected resources
For each message type, identify the resource it reads or changes and the server-side permission decision. Treat client-supplied tenant, role, and room fields as requests to validate, not trusted connection properties.
| Message | Resource boundary | Required negative case |
|---|---|---|
| Subscribe to document | Current read permission | Other tenant's document produces no subscription |
| Edit document | Current write permission | Viewer cannot mutate through the socket |
| Join workspace feed | Current membership | Removed member receives no new private events |
| Start export | Action and data scope | A room identifier cannot widen export authority |
Check outgoing broadcasts as well as incoming commands. A correctly denied edit does not compensate for a feed that still sends another workspace's data.
Change authority during a live connection
Use two synthetic users and controlled records. Establish a valid connection, then change one user's membership through the authorized test setup. Attempt the relevant operation again without reconnecting. Record the maximum permitted delay and the observed enforcement point.
Test session expiry and logout separately. A token refresh message must not let a client replace its identity with an unverified claim. If the implementation closes connections on revocation, confirm that reconnecting with the old credential also fails.
Keep the regression tied to effects
Assert the resulting record state, subscription membership, and delivered messages. A generic error event is not sufficient if the mutation or broadcast occurred first. Include legitimate actions from the remaining authorized user to avoid treating a globally broken channel as a passing denial.
Log message type and a bounded decision reason without recording sensitive message bodies. Save the tested build, identity transitions, and enforcement timing. Revisit the matrix when adding a new message type or shared room service. The completed evidence should show that current authority governs each protected action, even when the connection itself predates the permission change.
Find the gaps before your next launch
Use the release checklist to identify changed security boundaries and missing evidence. Discuss the application paths you want reviewed before launch.