How do you design authentication and authorization in WebSocket systems?

Authentication is done during handshake using tokens, and authorization is enforced per message or channel.

WebSockets do not have built-in auth, so JWT or session tokens are passed during handshake or query params. After connection, each message is validated for permissions based on user roles and channel access rules.