I’m currently developing a real-time notification system on my Symfony 6 application with Mercure ????

It works perfectly, for example my user Paul will receive notifications if a message is sent in a text chat where he is a participant ????

However, I have a small security question: how do I know if a user has the right to subscribe to a topic ???? ?
For example, how can I prevent the user Paul from subscribing to Marie’s notification topic (https://example.com/notifications/marie)?

Because if I’ve understood correctly, the JWT is only used to determine whether the Mercury Hub authorizes the connection, but it seems to me that we have no control over which topics are registered…
What prevents a malicious user from retrieving his mercureAuthorization cookie and using his own JWT to listen to other users’ notifications ?

Thanks in advance for your answers!

A small extract from my code for the moment:

Twig file :

`

…

`

JavaScript :

const url = document.querySelector('#notifications').getAttribute("data-mercure-notification") const eventSource = new EventSource(url, { withCredentials : true }); eventSource.onmessage = (e) => { console.log("Message sent ! :" + e) }

PHP :

`
public function publishNotifications(string $login, string $message): void
{
$update = new Update(
“/notifications/” . $login,
$message,
true
);

    // HubInterface $hub
    $this->hub->publish($update);

}

`