I'm sorry, I don't understand what you're saying...

Either there needs to be a check that the validMsgObject's 'from' field is correct against the origin of the websocket, or each method being invoked needs to be given the origin field in order to validate it itself.