What's the correct way to use Ory to authenticate websocket connections between our front end and back end code?

We did this in the exact same way as for regular requests, we simply validate the session (using the session cookie in the request) in the listener before the upgrade to websocket happens. Then we tear down and re-establish the websocket every three minutes. If we were smarter, we would save the session state along side the websocket server, and ask the client to reauthenticate when the session expires, however, I haven't been bothered yet 😇

... however, I haven't been bothered yet 😇

User profile picture checks out.