Server-Sent Events Security: How EventSource Breaks Your API Authentication Model

Your REST API requires a Bearer token on every request. Your WebSocket upgrade validates the token...