Agent-ready workflow · realtime
WebSocket Channel Authorization
Map upgrade, authentication, subscription, channel, message, and reconnect states with controlled identities.
Entry contract
Enter with artifacts, leave with evidence.
Use when
- WebSocket upgrade
- subscription ID
- channel name
- reconnect token
- realtime events
Prerequisites
- two controlled accounts
- controlled channel or object
- message cap
MCP retrieval
Agents can search this workflow, retrieve the complete graph, or request one stage through the read-only Vulns.co MCP connector.
Map the protocol states
Record upgrade headers, auth messages, subscriptions, acknowledgements, heartbeats, errors, and reconnect behavior.
Inputs
- controlled realtime traffic
Outputs
- message catalog
- state diagram
- Evidence gate
- Each message type records required state and identity.
- Negative control
- Pre-auth and expired-session behavior are captured.
- Stop condition
- No flooding or broad channel enumeration.
Build the channel matrix
Map identities, tenants, objects, channel names, and allowed publish or subscribe actions.
Inputs
- message catalog
Outputs
- channel authorization matrix
- Evidence gate
- Every test channel belongs to a controlled account or object.
- Negative control
- Nonexistent channel behavior is recorded.
- Stop condition
- No uncontrolled recipients.
Change one message property
Replay one subscription or action with only identity, channel, object, or message type changed.
Inputs
- known-good message
Outputs
- paired realtime evidence
- Evidence gate
- Unauthorized data or reversible state crosses the expected boundary.
- Negative control
- Original owner and expected-deny messages bracket the result.
- Stop condition
- Stop after minimal controlled proof.
Check reconnect and revocation
Compare session expiry, logout, role change, token rotation, and reconnect behavior.
Inputs
- controlled session transitions
Outputs
- revocation matrix
- Evidence gate
- Stale authorization remains usable after a documented invalidation event.
- Negative control
- Fresh authorized reconnect works normally.
- Stop condition
- Close test sockets and restore role state.
Related methods
Continue with the right depth.
Sources