WebSocket
A full-duplex, persistent channel for real-time apps — chat, live dashboards, multiplayer — established by upgrading an ordinary HTTP request and then speaking a lightweight message framing.
What it is
WebSocket (RFC 6455) starts as an HTTP request with Upgrade: websocket; the server replies 101 Switching Protocols and the same TCP connection becomes a bidirectional message stream. Unlike request/response HTTP, either side can send at any time with minimal per-message overhead.
OPENING HANDSHAKE
GET /ws HTTP/1.1
Host: example.com
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==
Sec-WebSocket-Version: 13Always use wss://
ws:// is plaintext. Use wss:// (WebSocket over TLS) in production so messages are encrypted and cannot be tampered with by intermediaries.
Why it matters
- It enables true real-time features without the overhead and latency of HTTP polling.
- Running over port 443 with TLS lets it traverse most firewalls and proxies.
Common mistakes
- Using ws:// in production instead of encrypted wss://.
- Reverse proxies that strip Upgrade/Connection headers, breaking the handshake.
How WebInspect checks this
- The API Inspector connects to WebSocket endpoints, capturing the handshake, subprotocol, extensions and round-trip time.