SecWebSocketAccept

SecWebSocketAccept, typically observed as the Sec-WebSocket-Accept HTTP header, is used by a WebSocket server during the opening handshake to confirm that the server has accepted the upgrade from HTTP to the WebSocket protocol. It is defined in RFC 6455 as part of the handshake mechanism that establishes a WebSocket connection.

During the handshake, the client sends an upgrade request that includes the Sec-WebSocket-Key header, a base64-encoded random value. The server must compute a response value by taking the client’s key, appending the globally unique identifier 258EAFA5-E914-47DA-95CA-C5AB0DC85B11, applying the SHA-1 hash to the resulting string, and base64-encoding the hash. The server then includes this computed value in the Sec-WebSocket-Accept header of the 101 Switching Protocols response.

The client, upon receiving the server’s response, performs the same computation with its original key to verify that the Sec-WebSocket-Accept value matches the expected result. This exchange ensures that both parties have agreed to establish a WebSocket connection and prevents certain spoofing attacks during the handshake.

Sec-WebSocket-Accept is only relevant to the initial upgrade phase; after the handshake completes, data frames are exchanged over the established WebSocket connection and the header is no longer used. It is one component of the overall WebSocket handshake, which may also involve optional subprotocol and extensions negotiation via other headers such as Sec-WebSocket-Protocol and Sec-WebSocket-Extensions.