Authentication with Apollo subscriptions
In Chapter 6, Authentication with Apollo and React, we implemented authentication through the local storage of your browser. The backend generates a signed JWT that the client sends with every request inside the HTTP headers. In Chapter 9, Implementing Server-Side Rendering, we extended this logic to support cookies to allow SSR. Now that we've introduced WebSockets, we need to take care of them separately, as we did with the SRR and our GraphQL API.
How is it possible for the user to receive new messages when they aren't authenticated on the backend for the WebSocket transport protocol?
The best way to figure this out is to have a look at your browser's developer tools. Let's assume that we have one browser window where we log in with user A. This user chats with another user, B. Both send messages to each other and receive the new updates directly in their chat window. Another user, C, shouldn't be able to receive...
