Sec-WebSocket-Key header
BaselineWidely available
This feature is well established and works across many devices and browser versions. It’s been available across browsers since July 2015.
The HTTPSec-WebSocket-Keyrequest header is used in theWebSocket openinghandshake to allow a client (user agent) to confirm that it "really wants" to request that an HTTP client is upgraded to become a WebSocket.
The value of the key is computed using an algorithm defined in the WebSocket specification, so thisdoes not provide security.Instead, it helps to prevent non-WebSocket clients from inadvertently, or through misuse, requesting a WebSocket connection.
This header is automatically added by user agents when a script opens a WebSocket; it cannot be added using thefetch() orXMLHttpRequest.setRequestHeader() methods.
The server'sSec-WebSocket-Accept response header should include a value computed based upon the specified key value.The user agent can then validate this before this before confirming the connection.
| Header type | Request header |
|---|---|
| Forbidden request header | Yes (Sec- prefix) |
Syntax
Sec-WebSocket-Key: <key>Directives
<key>The key for this request to upgrade.This is a randomly selected 16-byte nonce that has been base64-encoded and isomorphic encoded.The user agent adds this when initiating the WebSocket connection.
Examples
WebSocket opening handshake
The client will initiate a WebSocket handshake with a request like the following.Note that this starts as an HTTPGET request (HTTP/1.1 or later), in addition toSec-WebSocket-Key, the request includes theUpgrade header, indicating the intent to upgrade from HTTP to a WebSocket connection.
GET /chat HTTP/1.1Host: example.com:8000Upgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==Sec-WebSocket-Version: 13The response from the server should include theSec-WebSocket-Accept header with a value that is calculated from theSec-WebSocket-Key header in the request, and confirms the intent to upgrade the connection to a WebSocket connection:
HTTP/1.1 101 Switching ProtocolsUpgrade: websocketConnection: UpgradeSec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=Specifications
| Specification |
|---|
| The WebSocket Protocol # section-11.3.1 |