Does CRSF also works with WebSockets? The browser sends cookies in the websocket handshake. If the server application uses the cookies for authentication, then

Does CRSF also works with WebSockets? The browser sends cookies in the websocket handshake. If the server application uses the cookies for authentication, then a malicious web site can act on behalf of a user without the user's knowledge. How it can be prevented using Origin header? The server application can reject requests originating from other sites.