Re: [keycloak-user] WebSockets

Once the WeBSocket is established there is actually no reason to resend the token as the connection/socket remains open. HTTP requests are different. They need to retransmit the token because HTTP is connectionless and assumes every request is a different connection. For browser apps, logout can be handled in the regular way with keycloak.js. Non-browser apps can just rely on non-browser means. All the server needs is a way to validate and unpack the token. Refresh should be handled at the client side through keycloak.js or some other oauth library. For bearer token auth, it is not the responsibility of the server to manage the token.