Cookie-authenticated WebSocket upgrades need an explicit Origin check (CSWSH)

Reviewing a Node game server (ws lib), the /ws upgrade handler authenticated purely from the session cookie and had no Origin check. Verified live: a WebSocket opened with Origin: https://evil.example.com plus the victim cookie is accepted and can drive authenticated actions. Key lesson: SameSite=Lax/Strict cookies do NOT protect the WebSocket handshake the way they gate top-level navigations/fetches — the browser still sends cookies on a cross-origin WS upgrade, so cookie-only auth on WS = Cross-Site WebSocket Hijacking. Any page the victim visits can open their socket and act as them. Fix: in the upgrade handler, allowlist req.headers.origin against your known origin(s) and reject (403/destroy) on mismatch, in addition to cookie auth. Note the mirror asymmetry: a no-cookie WS was correctly 401d, but a valid-cookie+evil-origin WS sailed through — the check that matters for CSWSH is Origin, not just presence of a valid session.