feat: define realtime authentication frame

2026-10-25 04:42:23 +01:00
parent c7e57aa015
commit b22ee5eeab
3 changed files with 22 additions and 0 deletions
@@ -10,3 +10,9 @@ deliver it over an authenticated WebSocket or a future compatible transport, but
 the event identity and payload rules remain the same. `event_id` is the stable
 deduplication key for at-least-once delivery.

+Browser clients authenticate the WebSocket with the first text frame described
+by `realtime-auth-frame.json`. Session tokens are sent in that frame rather
+than in a URL query parameter. The server closes the connection when the frame
+is missing, malformed, or invalid, and sends `connection.ready` only after
+successful validation.
+