AlexxIT/go2rtc · error

wrong websocket accept

Error message

wrong websocket accept

What it means

WebSocket Dial accept guard: the server did return 101, but the Sec-Websocket-Accept header does not equal the SHA1/base64 of the sent Sec-WebSocket-Key. The handshake response is invalid per RFC 6455 — a broken intermediary or non-compliant server generated the wrong accept value.

Solutions

1. Verify no proxy rewrites or caches the 101 response
2. Test the endpoint with a standard WebSocket client to confirm server compliance
3. Update or bypass the non-conformant server/intermediary

When it happens

Trigger: Thrown at pkg/tcp/websocket/dial.go:48 when the library encounters an invalid state.

Common situations: See trigger scenarios.

AI-assisted analysis of AlexxIT/go2rtc@c245815e75 (2026-09-07). Data as JSON: /api/errors/57a8df4b614d9a11. Report an issue: GitHub.

Appendix: source

Thrown at pkg/tcp/websocket/dial.go:48

	// Version, Key, Protocol important for Axis cameras
	req.Header.Set("Connection", "Upgrade")
	req.Header.Set("Upgrade", "websocket")
	req.Header.Set("Sec-WebSocket-Version", "13")
	req.Header.Set("Sec-WebSocket-Key", key)
	req.Header.Set("Sec-WebSocket-Protocol", "binary")

	res, err := tcp.Do(req)
	if err != nil {
		return nil, err
	}

	if res.StatusCode != http.StatusSwitchingProtocols {
		return nil, errors.New("wrong status: " + res.Status)
	}

	if res.Header.Get("Sec-Websocket-Accept") != accept {
		return nil, errors.New("wrong websocket accept")
	}

	return NewClient(*pconn), nil
}

func GetKeyAccept() (key, accept string) {
	b := make([]byte, 16)
	_, _ = cryptorand.Read(b)
	key = base64.StdEncoding.EncodeToString(b)

	h := sha1.New()
	h.Write([]byte(key))
	h.Write([]byte("258EAFA5-E914-47DA-95CA-C5AB0DC85B11"))
	accept = base64.StdEncoding.EncodeToString(h.Sum(nil))

	return
}

View on GitHub (pinned to c245815e75)