Web Protocols

WebSocket

A full-duplex, persistent channel for real-time apps — chat, live dashboards, multiplayer — established by upgrading an ordinary HTTP request and then speaking a lightweight message framing.

What it is

WebSocket (RFC 6455) starts as an HTTP request with Upgrade: websocket; the server replies 101 Switching Protocols and the same TCP connection becomes a bidirectional message stream. Unlike request/response HTTP, either side can send at any time with minimal per-message overhead.

OPENING HANDSHAKE
GET /ws HTTP/1.1
Host: example.com
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13

Always use wss://

ws:// is plaintext. Use wss:// (WebSocket over TLS) in production so messages are encrypted and cannot be tampered with by intermediaries.

Why it matters

  • It enables true real-time features without the overhead and latency of HTTP polling.
  • Running over port 443 with TLS lets it traverse most firewalls and proxies.

Common mistakes

  • Using ws:// in production instead of encrypted wss://.
  • Reverse proxies that strip Upgrade/Connection headers, breaking the handshake.

How WebInspect checks this

  • The API Inspector connects to WebSocket endpoints, capturing the handshake, subprotocol, extensions and round-trip time.