HTTP Headers
Sec WebSocket Accept
HTTP Header
The HTTP Sec-WebSocket-Accept response header is used in the WebSocket opening handshake to indicate that the server is willing to upgrade to a WebSocket connection.
This header must appear no more than once in the response, and has a directive value that is calculated from the <code>Sec-WebSocket-Key</code> request header sent in the corresponding request.
This header is a response header that signifies the server’s acceptance of the WebSocket connection request. It is generated by combining the client’s Sec-WebSocket-Key with a fixed GUID, hashing the result, and then base64-encoding that hash. This process ensures the security and integrity of the WebSocket handshake.
<aside >
Note: The Sec-WebSocket-Accept header is set by the server to agree to upgrade the connection to WebSocket. It is derived exclusively from the client-sent Sec-WebSocket-Key header and is critical in confirming the handshake’s validity.
</aside>
Syntax
http
Sec-WebSocket-Accept: <hashed key>Directives
Directives
<hashed key>If a
Sec-WebSocket-Keyheader was provided, the value of this header is computed by taking the value of the key, concatenating the string258EAFA5-E914-47DA-95CA-C5AB0DC85B11, and taking the SHA-1 hash of that concatenated string — resulting in a 20-byte value.
That value is then base64 encoded to obtain the value of this property.
Example
The client initiates a WebSocket handshake using a request similar to the example below.
Note that this begins as an HTTP GET request (HTTP/1.1 or later) and includes the Upgrade header, indicating the desire to establish a WebSocket connection.
It also contains the Sec-WebSocket-Key, which is utilized in calculating the Sec-WebSocket-Accept to verify the upgrade request.
Example of a WebSocket opening handshake request:
GET /chat HTTP/1.1
Host: example.com:8000
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13
The server responds with a header that confirms the upgrade, including a Sec-WebSocket-Accept value derived from the client’s key:
HTTP/1.1 101 Switching Protocols
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=
How to Modify Header using Requestly
Requestly is a powerful Chrome extension that allows you to modify HTTP headers, including the Sec-WebSocket-Accept header. This can be helpful for debugging WebSocket connections or simulating how your server handles different handshake responses. Steps to Modify the Sec-WebSocket-Accept Header:
- Install and open the Requestly Chrome extension. You can find it on the Chrome Web Store.
- Create a new rule: Click on “Create Rule” and choose “Modify Headers” from the list of available rule types.
- Add a new header modification:
- Under “Action”, select “Add” or “Override”.
- In the “Header Name” field, enter Sec-WebSocket-Accept.
- In the “Header Value” field, enter the desired accept key value (a base64-encoded SHA-1 hash usually).
- Set the URL condition: Specify the WebSocket URL or pattern where this header change should apply (e.g., wss://your-websocket-server.com/*).
- Save the rule.
Once set up, Requestly will inject your custom Sec-WebSocket-Accept header into all matching WebSocket handshake responses, which can help you test how clients behave with altered handshake validations.
Modifying the Sec-WebSocket-Accept header can help developers troubleshoot handshake failures or experiment with custom server responses. It’s useful when you want to simulate different WebSocket connection scenarios without changing the actual server.
Table of Contents
- No headings found.
