I didn’t include any CSRF token in my script though and it worked from time to time. I feel it’s because I am not sending RT ping messages. According to OGS API notes,
the client should send RT ping messages every so often (20 seconds works) to keep the RT connection alive.
However, I can still receive the response from the server when I play a move in the browser without sending the ping message. That means the socket connection is still there. I am not sure what the browser is doing and the code is not…