title: Spring Websocket Security: How to prevent SEND request directly to the broker
body: <p>Spring Websocket allows clients (I.e. Browsers) to directly send messages to any broker-backed destination, I.e. Allowing direct client-to-client communication bypassing the server-side application. In real world, I don't think it's acceptable to publicly expose write-access directly to your message broker. For security and message-integrity reason, you'll usually want to allow only the server application to ever send any message to the clients via the broker. But I can't find any information on how to achieve this. The default behaviour is browsers have unrestricted read+write direct access to broker destinations.</p>