A municipal chat feature uses WebSockets for permit-status actions. What authorization concern should the tester apply?
Select an answer to reveal the explanation.
Short Explanation
A side door still needs a lock. WebSockets are just another channel into the same business actions — if HTTP checks who may update a permit, the socket messages need the same checks. Skipping them because they are not REST is how IDOR-class bugs hide in plain sight.
Full Explanation
Non-HTTP channels such as WebSockets still invoke server-side actions that require authentication and authorization. Testers should extend IDOR-class and privilege checks to message handlers, not assume REST-only coverage. An open socket is not automatically RCE, and weakening transport encryption is never a remediation recommendation. Document missing authz on WebSocket actions with the same rigor used for HTTP APIs.