Glossary
WebSocket
A WebSocket connection is established once and then stays open for an extended, often unpredictable duration, carrying messages in both directions without the repeated request-response cycle of ordinary HTTP calls. Authorization for it is usually checked at connection time, which raises a specific question ordinary short-lived requests don't: what happens to an already-open connection if the access that authorized it is revoked while the connection is still live.
A system that checks authorization only once, at the handshake, and never again for the life of a long-running connection, can end up honoring access that's since been revoked for as long as that connection happens to stay open. Re-validating periodically, or tying the connection's lifetime to the credential's own expiry, closes that gap.