title: What are the security issues around an open websocket connection?
body: <p>I am building an application that is using websockets.  I am only going to allow authenticated users to open a websocket connection with the server after they have logged in and have been granted a session id.</p>
  
  <ol>
  <li><p>Once I have opened a websocket connection with an authenticated user, the current "page" then holds the details of the open websocket connection.  At this point, is this connection relatively safe?  Or should I really be checking some token on every message within my own application level protocol that comes in over the websocket?</p></li>
  <li><p>Are there any known cross-site forgery type security issues?  Where someone could coop an open websocket by getting the authenticated user to execute some javascript in some manner - resulting in the ability to exploit the open websocket connection?</p></li>
  </ol>