Socket.IO JWT middleware token expiration handling on reconnection

The default @socket.io/jwt middleware validates a JWT only during the initial handshake. In Socket.IO v4.x the connection remains open after the token expires unless the server explicitly re‑validates on each reconnection or per message.

Because the middleware does not enforce a maximum token lifetime beyond the handshake, a client with an expired token can stay connected indefinitely, which may be unacceptable for security‑sensitive deployments.

Testing this behavior without production credentials is typically done by generating a short‑lived test JWT signed with the same secret, then observing whether the connection is dropped after the next handshake attempt.

Should the middleware automatically re‑validate tokens on each reconnection attempt? What configuration options exist to enforce per‑message validation? How can a test suite reliably simulate token expiry without production secrets?