- Shipped
- September 24, 2026 at 9:28 PM UTC
- Author
- Kamo
- Commit
- a657dec
Since 46191c47 every browser WebSocket authenticates with ?otk=<key>. The EmailService sockets connect through the same-origin /email-ws rewrite, so they pass through proxy.ts - whose older OTK rule sends any ?otk= URL to /validate as a sign-in hand-off. Every SockJS handshake was answered with a 307 to /validate (curl /email-ws/info?otk=x shows it), and EmailService's broker stats read 0 WebSocket sessions, 0 CONNECTs on both pods. The mail badge, the mail list, the notification bell, calendar and contact-sync changes and campaign progress all stopped being live together; the badge only moved on its REST fallback when the tab regained focus. MediaService sockets were spared because they go to their own host. The socket rewrite paths (/email-ws, /image-pipeline-ws) are exempt from the hand-off redirect; a page with ?otk= still goes through /validate. A test runs the real proxy against handshake URLs and holds the exemption list to the /ws rewrites declared in next.config.mjs.