Authenticating the Socket

HTTP auth doesn't just carry over

Since module 10, every controller action has relied on Authentication's before_action :authenticate_request — it reads request.headers["Authorization"], splits off the bearer token, decodes the JWT, and sets current_user. That's an HTTP request/response cycle: headers are cheap to set on every call.

A WebSocket connection is different: it's ONE handshake, held open, and depending on the client, custom headers aren't always easy or possible to attach to that handshake. So Action Cable's connection auth can't just reuse authenticate_request — it needs its own entry point, running once, at connect time.