How to reject WebSocket connections from compromised client-side?

How to reject WebSocket connections from compromised client-side?

How can a WebSocket server be certain that a connection is the result of
legitimate client-side code served from the web server or WebSocket server
itself?
The case I'm worried about is malicious client-side code that is identical
to my own, but it has a keylogger or worse.