Authentication occurs during the HTTP Upgrade phase before any WebSocket connection object is instantiated, preventing unauthenticated clients from consuming transport memory.
The authenticator hook receives the raw Node IncomingMessage and has a 5,000ms deadline (authTimeoutMs). If the deadline expires, the server returns HTTP 408.
1// Inbound Packet Middleware (runs after JSON decoding & validation)1io.use((packet, context, next) => {1 // Reject unauthenticated publishes to admin events1 if (packet.type === "event" && packet.event.startsWith("admin.")) {1 if (context.metadata.role !== "admin") {1 return next(new Error("Administrator credentials required"));1 }1 }1 next();1});
