socket.io not protected by jwt?

[davisford]

I don't see anywhere where you configure socket.io to use jwt like the example shown here

That mean the websocket is open to any connection?