What are the security considerations for WebSocket connections?

WebSocket security requires attention to: (1) Always use wss:// — encrypt connections to prevent eavesdropping and man-in-the-middle attacks; (2) Origin validation — check the Origin header during handshake to prevent cross-site WebSocket hijacking (CSWSH); (3) Authentication — validate tokens/sessions before accepting the connection, not after; (4) Input validation — WebSocket messages bypass web application firewalls; validate and sanitize all incoming data server-side; (5) Rate limiting — limit message rate per connection to prevent DoS; (6) Message size limits — enforce maximum message size to prevent memory exhaustion; (7) DoS protection — limit the number of open connections per IP; (8) Avoid broadcasting sensitive data — validate that the recipient is authorized to receive each message; (9) CSRF — WebSockets are not susceptible to traditional CSRF (cookies are sent but the server validates Origin), but token-based auth eliminates any ambiguity.