Why I can StompCommand.CONNECT without JSESSIONID, but X-XSRF-TOKEN is required?

Question

My goal is to secure a WebSocket endpoint e.g ws://localhost:8080/chat.

What I did:

1. I tried to create WebSocket connection with STOMP