A WebSocket reconnect is not a free pass
A long-lived WebSocket often authenticates once at connect time. That is necessary, not sufficient. On reconnect, after a resume token, or when the client re-subscribes to a channel, re-check authorization against current membership and roles. People get offboarded, plans change, and channel grants expire while sockets stay "alive" in clients' minds. Treat every subscribe/resume as a fresh…
We haven't written up this one. Dev.to has the full story — the link below goes straight to it.
