{"record":{"id":"41dc4551b1e3631a","repo":"TooTallNate/Java-WebSocket","slug":"missing-sec-websocket-key","errorCode":null,"errorMessage":"missing Sec-WebSocket-Key","messagePattern":"missing Sec-WebSocket-Key","errorType":"exception","errorClass":"InvalidHandshakeException","httpStatus":null,"severity":"error","filePath":"src/main/java/org/java_websocket/drafts/Draft_6455.java","lineNumber":439,"sourceCode":"        }\n        requestedProtocols.append(knownProtocol.getProvidedProtocol());\n      }\n    }\n    if (requestedProtocols.length() != 0) {\n      request.put(SEC_WEB_SOCKET_PROTOCOL, requestedProtocols.toString());\n    }\n    return request;\n  }\n\n  @Override\n  public HandshakeBuilder postProcessHandshakeResponseAsServer(ClientHandshake request,\n      ServerHandshakeBuilder response) throws InvalidHandshakeException {\n    response.put(UPGRADE, \"websocket\");\n    response.put(CONNECTION,\n        request.getFieldValue(CONNECTION)); // to respond to a Connection keep alives\n    String seckey = request.getFieldValue(SEC_WEB_SOCKET_KEY);\n    if (seckey == null || \"\".equals(seckey)) {\n      throw new InvalidHandshakeException(\"missing Sec-WebSocket-Key\");\n    }\n    response.put(SEC_WEB_SOCKET_ACCEPT, generateFinalKey(seckey));\n    if (getExtension().getProvidedExtensionAsServer().length() != 0) {\n      response.put(SEC_WEB_SOCKET_EXTENSIONS, getExtension().getProvidedExtensionAsServer());\n    }\n    if (getProtocol() != null && getProtocol().getProvidedProtocol().length() != 0) {\n      response.put(SEC_WEB_SOCKET_PROTOCOL, getProtocol().getProvidedProtocol());\n    }\n    response.setHttpStatusMessage(\"Web Socket Protocol Handshake\");\n    response.put(\"Server\", \"TooTallNate Java-WebSocket\");\n    response.put(\"Date\", getServerTime());\n    return response;\n  }\n\n  @Override\n  public Draft copyInstance() {\n    ArrayList<IExtension> newExtensions = new ArrayList<>();\n    for (IExtension knownExtension : getKnownExtensions()) {","sourceCodeStart":421,"sourceCodeEnd":457,"githubUrl":"https://github.com/TooTallNate/Java-WebSocket/blob/afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d/src/main/java/org/java_websocket/drafts/Draft_6455.java#L421-L457","documentation":"When acting as a server, Draft_6455 must include the Sec-WebSocket-Accept header in the 101 response, computed from the client's Sec-WebSocket-Key per RFC 6455. If the incoming client handshake lacks a Sec-WebSocket-Key header (empty or missing), postProcessHandshakeResponseAsServer throws this InvalidHandshakeException and the upgrade fails.","triggerScenarios":"A client connects without sending the Sec-WebSocket-Key header — e.g. a hand-rolled HTTP client, a health check or plain HTTP probe hitting the WS port, or a very old/non-conformant WebSocket client.","commonSituations":"Load balancer health checks port-scanning the WebSocket server, custom client code forgetting the required handshake headers, tools sending plain HTTP requests to the WS endpoint.","solutions":["Make the connecting client send Sec-WebSocket-Key (any real RFC 6455 client library does)","Exclude the WebSocket port from health-check probes or configure a TCP-level check instead","If writing a raw client, include \"Sec-WebSocket-Key: <base64 16-byte value>\" in the request","Log the offending client handshake to identify the non-conformant source"],"exampleFix":"// before (raw client request)\noutput.write(\"GET /ws HTTP/1.1\\r\\nUpgrade: websocket\\r\\nConnection: Upgrade\\r\\n\");\n// after\noutput.write(\"GET /ws HTTP/1.1\\r\\nUpgrade: websocket\\r\\nConnection: Upgrade\\r\\nSec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==\\r\\n\");","handlingStrategy":"try-catch","validationCode":"// before accepting an upgrade as server, verify the client sent the key\nString key = request.getFieldValue(\"Sec-WebSocket-Key\");\nif (key == null || key.isEmpty()) {\n  // reject/hand off: not a valid RFC 6455 client\n  return AbortHandshake.forInvalidRequestCode(400);\n}","typeGuard":null,"tryCatchPattern":"public ServerHandshakeBuilder onWebsocketHandshakeReceivedAsServer(WebSocket conn, Draft draft, ClientHandshake request) throws InvalidHandshakeException {\n  if (request.getFieldValue(\"Sec-WebSocket-Key\").isEmpty())\n    throw new InvalidHandshakeException(\"not a WebSocket client\");\n  return super.onWebsocketHandshakeReceivedAsServer(conn, draft, request);\n}","preventionTips":["Exclude the WS port from plain HTTP health checks","Use real RFC 6455 client libraries","Log offending handshakes to identify probes and broken clients"],"tags":["websocket","handshake","missing-header"],"backgroundTag":"missing-required-config-field","analyzedSha":"afeacbf8c0f6f6a761c9d9daed8c813dd3b8ed7d","analyzedAt":"2026-09-09T14:39:47.546Z","contentChangedAt":"2026-09-09T14:39:47.546Z","schemaVersion":2},"datasetVersion":"2026-09-16T09:17:16.951Z"}