[crummy]

> it doesn't suffer from most WebSocket limitations (e.g. header/cookie based authorization works)

Don't WS connections send headers? What's the limitation here?

[chalas_r]

Actually neither the WebSocket nor the SSE browser APIs allow to send custom headers (see https://stackoverflow.com/q/4361173/4363634, https://stackoverflow.com/q/36201347/4363634). Point is that the Mercure protocol specifies the authorization part deeply so it's handled out of the box. With WebSocket you are on your own.