R004

A wildcard in realtime({ origins }), or a hand-written WebSocket handler (crossws, defineWebSocketHandler) that skips the Origin check: any site could join with a visitor's cookies.

Fix: List the origins, scheme and port included; use channel.

Status in weft@0.1.0: reported by @weft-js/start when it serves or renders the route, and by weft check and weft routes --meta.