The auth headers (Authorization, Cookie) are all passed along, and that's what I want to establish a secure connection from the browser. For more customized wi

The auth headers (Authorization, Cookie) are all passed along, and that's what I want to establish a secure connection from the browser. For more customized wishes there's always this "ticket"-based flow[0][1] that shouldn't be hard to implement. I might be a bit naive, but what needed metadata and custom headers are we talking about? [0]: https://devcenter.heroku.com/articles/websocket-security#authentication-authorization https://devcenter.heroku.com/articles/websocket-security#aut... [1]: https://lucumr.pocoo.org/2012/9/24/websockets-101/#authorization-and-ips https://lucumr.pocoo.org/2012/9/24/websockets-101/#authoriza...