- Shipped
- September 3, 2026 at 6:35 PM UTC
- Author
- Kamo
- Commit
- 0b36209
Found by probing the deployed endpoint, not by reading it. Returning false from a HandshakeInterceptor aborts the handshake but sets nothing on the response, so every refusal — no ticket, forged ticket, cross-site origin — went out as a bare 200 with an empty body. No socket was ever established and nothing was let through, but from the outside a refusal was indistinguishable from success, and anything monitoring this endpoint would have read one as the other. Now 401 for a ticket that is absent, forged, spent or expired, and 403 for an origin that is not the host being addressed. The reason stays vague on purpose: telling an unknown ticket apart from a spent one is how you probe for which tokens existed. Nine tests over the gate, including the two that matter most — a cross-site handshake is refused BEFORE the ticket is looked at, so a valid ticket presented from another origin is not spent and is still there for the member's own browser; and the client cannot name an account or a session however it decorates the query string, because both come from the ticket.