I've been using Burp Suite to do some testing on a game that uses websockets(wss). At the beginning of the connection, the server sends some basic meta data to the client(certain characters that have been unlocked, current game volume, etc.). It was my understanding that if I altered the game messages from the server prior to arriving at the client, the client wouldn't know there were changes made, but instead the connection is dropped and a new connection is established, resending the same meta data.

I imagine that there must be some client side data verification prior to loading the game and that is what is preventing the altered messages from coming through, possibly using the session token as part of the process. That seems counterintuitive since the client must then already have some knowledge of that data to do that verification. I would understand if it were the server side since things can be cross referenced, but not through the client side. What type of strategy do you think are being deployed in this type of socket connection? I haven't seen anything in regards to client side websocket message verification and wanted to know if this is a standard way to handle users trying to alter your packets.