{"record":{"id":"bed9222bd3d08517","repo":"gorilla/websocket","slug":"websocket-internal-error-extra-used-in-client-mo","errorCode":null,"errorMessage":"websocket: internal error, extra used in client mode","messagePattern":"websocket: internal error, extra used in client mode","errorType":"exception","errorClass":null,"httpStatus":null,"severity":"error","filePath":"conn.go","lineNumber":617,"sourceCode":"\t\tc.writeBuf[framePos+1] = b1 | 127\n\t\tbinary.BigEndian.PutUint64(c.writeBuf[framePos+2:], uint64(length))\n\tcase length > 125:\n\t\tframePos += 6\n\t\tc.writeBuf[framePos] = b0\n\t\tc.writeBuf[framePos+1] = b1 | 126\n\t\tbinary.BigEndian.PutUint16(c.writeBuf[framePos+2:], uint16(length))\n\tdefault:\n\t\tframePos += 8\n\t\tc.writeBuf[framePos] = b0\n\t\tc.writeBuf[framePos+1] = b1 | byte(length)\n\t}\n\n\tif !c.isServer {\n\t\tkey := newMaskKey()\n\t\tcopy(c.writeBuf[maxFrameHeaderSize-4:], key[:])\n\t\tmaskBytes(key, 0, c.writeBuf[maxFrameHeaderSize:w.pos])\n\t\tif len(extra) > 0 {\n\t\t\treturn w.endMessage(c.writeFatal(errors.New(\"websocket: internal error, extra used in client mode\")))\n\t\t}\n\t}\n\n\t// Write the buffers to the connection with best-effort detection of\n\t// concurrent writes. See the concurrency section in the package\n\t// documentation for more info.\n\n\tif c.isWriting {\n\t\tpanic(\"concurrent write to websocket connection\")\n\t}\n\tc.isWriting = true\n\n\terr := c.write(w.frameType, c.writeDeadline, c.writeBuf[framePos:w.pos], extra)\n\n\tif !c.isWriting {\n\t\tpanic(\"concurrent write to websocket connection\")\n\t}\n\tc.isWriting = false","sourceCodeStart":599,"sourceCodeEnd":635,"githubUrl":"https://github.com/gorilla/websocket/blob/e064f32e3674d9d79a8fd417b5bc06fa5c6cad8f/conn.go#L599-L635","documentation":"This internal sanity-check error is returned by the write path when the caller supplies an extra write buffer while the connection is operating in client mode. In client mode all frames must be masked with a single key, and the library can only apply one mask key to its internal buffer, so any extra bytes would be written unmasked — a protocol violation. It should never occur through normal API use.","triggerScenarios":"An internal code path calls w.write with a non-empty extra buffer on a client-side Conn; effectively unreachable via the public API unless the library internals are patched or a fork misuses NextWriter's buffer machinery.","commonSituations":"Custom forks or monkey-patched internals of gorilla/websocket; essentially never seen by application developers using the public API.","solutions":["Verify you are using the unmodified gorilla/websocket package and not a patched fork","If you maintain a fork, audit the NextWriter/write path so extra buffers are only passed for server (unmasked) writes","Upgrade to the latest gorilla/websocket version in case this was an internal bug that was fixed"],"exampleFix":null,"handlingStrategy":"try-catch","validationCode":null,"typeGuard":null,"tryCatchPattern":"// internal error — log and close\nif err := conn.WriteMessage(websocket.TextMessage, data); err != nil {\n    if strings.Contains(err.Error(), \"internal error\") {\n        log.Errorf(\"library internal error: %v\", err)\n        conn.Close()\n    }\n}","preventionTips":["Use the official unmodified gorilla/websocket package","Pin and review dependency versions; avoid patched forks"],"tags":["websocket","internal-error","client-mode"],"backgroundTag":"websocket-internal-error","analyzedSha":"e064f32e3674d9d79a8fd417b5bc06fa5c6cad8f","analyzedAt":"2026-08-31T12:40:58.222Z","schemaVersion":2},"datasetVersion":"2026-08-31T14:17:45.589Z"}