The socket that anyone could open
The socket endpoint authenticates with the session cookie, like everything else on the site. The team assumed the same-origin policy would stop another site connecting, the way it stops a cross-origin fetch.
It does not. A browser will open a socket from any page to any host, and it will send the cookies. There is no preflight, no negotiation, and no browser-side refusal — the specification puts this check on the server.
Boundaries, outermost first: Your origin: Your page Outside every boundary: Any other site (FAILED: opens one too), Socket endpoint (cookie is enough; FAILED: accepts anyone), Session cookie (sent on handshake), an empty slot for the checked at the handshake Connections: Your page calls checked at the handshake (step 1) checked at the handshake calls Socket endpoint — accepted (step 2) Any other site calls checked at the handshake (step 3) Any other site must NOT reach Socket endpoint — refused Session cookie controls checked at the handshake — sent either way