webSocketAllowedOrigins property
Turns on the Origin check for every Route.websocket route.
Off (null) by default: any site can open a socket from a browser,
with the cookies of the user. Set it to only allow pages of the same
host and the sites in the list, like ['https://app.example.com'].
[] means the same host only. Other origins get 403. The
allowedOrigins of a route wins over this.
Implementation
final List<String>? webSocketAllowedOrigins;