Turbo Streams Connection Persistence After Authentication Failure

Goal

Determine whether a Turbo Streams WebSocket connection remains open or automatically reconnects when the server detects that a user’s authentication has expired or been revoked.

Constraints

• Least‑privilege enforcement relies on server‑side middleware; the stream endpoint must reject messages from unauthenticated or unauthorized users.
• When a session token expires, the client may still hold a valid WebSocket connection unless the server explicitly closes it.
• Turbo 7.x introduced automatic reconnection with exponential back‑off, but earlier releases lack this feature, potentially leading to endless retry loops.

Unresolved Behavior

It is unclear whether Turbo will:

• close the socket and return a 401/403 response, causing the client to stop sending updates, or
• continue to retry the subscription indefinitely, possibly overwhelming the server.

Specific Questions

1. When a user’s credentials expire, does Turbo Streams send an immediate 401/403 response that terminates the WebSocket connection, or does the client keep the connection open?
2. If the connection persists, does Turbo 7.x apply exponential back‑off on reconnection attempts, and how does this differ from Turbo 6.x or earlier?
3. What server‑side hooks exist to force a disconnect or to notify the client of authentication failure within a Turbo Streams context?