Scenario 28: Your application needs to authenticate a WebSocket connection used for real-time account balance updates.

The WebSocket handshake itself is a normal HTTP request, so standard Spring Security filters (session cookie or Authorization header validation) can protect the initial handshake/upgrade request. After the connection is established, since WebSocket messages don't carry headers per-message the way HTTP requests do, the authenticated principal from the handshake is typically captured once and associated with the WebSocket session for the connection's lifetime.