CloudFront signed cookie scope excludes the websocket upgrade host and only the browser terminal loses auth

Static pages load normally, but the interactive browser tool fails because the signed cookie domain or path does not cover the upgraded endpoint host.