djust authentication bypass: a login_required / on_mount LiveView mount redirect does not close the WebSocket, allowing an unauthenticated client to dispatch event-handler calls
djust's LiveViewConsumer mounts a LiveView over a WebSocket. When a view is gated (login_required / permission_required, or an on_mount hook that returns a redirect) and the connecting user is not authorized, the consumer sent the client a {"type":"navigate","to":…} redirect frame and then returned — without closing the socket and without clearing self.view_instance. Only the PermissionDenied branch closed the connection (close(4403)). A real browser obeys the navigate frame and leaves, hiding …