Authorization on websockets? How to transfer a token?

Question

User identification

I understand that it is impossible to put your own headings (except for the protocol).
Cookies are not suitable due to cross-domain requests.
Only query remains, but how safe is it?
I want to authorize at the moment of connection, and not in subsequent onmessage.
What is the right way to do this on websockets?

Answer 1

1. Wss instead of WS
2. When connecting to a socket, send an auth message with a token (jwt, for example) and let the server remember this session until the token dies