SecWebSocketKey

SecWebSocketKey is an HTTP header field used by the WebSocket protocol during the opening handshake. Defined in RFC 6455, it is supplied by the client and later echoed back as part of the Sec-WebSocket-Accept response from the server to prove that the connection is intended for WebSocket.

The value is a base64-encoded representation of 16 random bytes produced by the client. It is not a secret; it is meant to be random and unique per handshake to help prevent certain types of unauthorized cross-protocol requests. The header is typically 24 characters long, including padding.

On the server side, the Sec-WebSocket-Key is processed by appending the fixed GUID 258EAFA5-E914-47DA-95CA-C5AB0DC85B11, computing the SHA-1 hash of the result, and base64-encoding that hash. The resulting string is sent back in the Sec-WebSocket-Accept header. If the value is missing or invalid, the server should reject the handshake.

Role and lifecycle: Sec-WebSocket-Key is only used during the initial handshake. After the connection is upgraded, it is no longer used. It helps ensure that both parties participate in a valid WebSocket upgrade rather than a plain HTTP request.

Interoperability and considerations: Implementations should generate a cryptographically secure random key and validate the computed Accept value. No confidential information should be derived from the key since it is exposed in plaintext during the handshake. The key, along with the Accept computation, is defined by the WebSocket protocol rather than by application data.