Pitanje
📝 **Питање:** Зашто се не препоручује слање ЈВТ у стрингу упита ВебСоцкет УРЛ адресе?
📋 Изаберите тачан одговор.
💡 **Савет:** Поново прочитајте горњу теорију ако нисте сигурни.
A WebSocket query-string tokens are cryptographically insecure because the WebSocket upgrade handshake encodes the URL in a way that makes brute-force easier than the equivalent HTTPS request would B Query strings are logged by load balancers, proxies, CDNs and browser history; a token in the URL ends up in many places it shouldn't — prefer the Sec-WebSocket-Protocol header pattern or a short-lived ticket exchanged for the long-lived JWT C The WebSocket specification explicitly forbids credentials in the URL and most browsers will refuse the connection with a CORS-style error when they see a token-shaped parameter in the query during the upgrade handshake D Putting the token in the URL breaks the automatic reconnection logic in the standard WebSocket client because the URL is treated as a unique key and reconnects under a new identity each time, dropping the auth context entirely