Issue a short-lived, single-use ticket for opening the realtime socket (ADR 0034 §3). A browser cannot set headers on a WebSocket, and a cookie is the wrong instrument across origins — so the ticket goes in the socket URL, which is why it must be worth little: it authenticates one upgrade, once, within seconds. The socket is the appview's primary surface (ADR 0011), so this is not an afterthought but the only authenticated path for most of what a client does.
Output
application/jsonTry It
Requests are sent directly from your browser. Some servers may block requests due to CORS.
View raw schema
{
"type": "procedure",
"output": {
"schema": {
"ref": "#output",
"type": "ref"
},
"encoding": "application/json"
},
"description": "Issue a short-lived, single-use ticket for opening the realtime socket (ADR 0034 §3).\n\nA browser cannot set headers on a WebSocket, and a cookie is the wrong instrument across origins — so the ticket goes in the socket URL, which is why it must be worth little: it authenticates one upgrade, once, within seconds. The socket is the appview's primary surface (ADR 0011), so this is not an afterthought but the only authenticated path for most of what a client does."
}