fix: add Connection header validation to IsWebSocket() (RFC 6455)

raju-mechatronics · aldas · commit f1d43af10542 · 2026-01-27T12:00:04.000+02:00
diff --git a/context.go b/context.go
@@ -153,7 +153,8 @@ func (c *Context) IsTLS() bool {
 // IsWebSocket returns true if HTTP connection is WebSocket otherwise false.
 func (c *Context) IsWebSocket() bool {
 	upgrade := c.request.Header.Get(HeaderUpgrade)
-	return strings.EqualFold(upgrade, "websocket")
+	connection := c.request.Header.Get(HeaderConnection)
+	return strings.EqualFold(upgrade, "websocket") && strings.Contains(strings.ToLower(connection), "upgrade")
 }
 
 // Scheme returns the HTTP protocol scheme, `http` or `https`.

Original file line number	Diff line number	Diff line change
`@@ -153,7 +153,8 @@ func (c *Context) IsTLS() bool {`
`153`	`153`	`// IsWebSocket returns true if HTTP connection is WebSocket otherwise false.`
`154`	`154`	`func (c *Context) IsWebSocket() bool {`
`155`	`155`	`upgrade := c.request.Header.Get(HeaderUpgrade)`
`156`		`- return strings.EqualFold(upgrade, "websocket")`
	`156`	`+ connection := c.request.Header.Get(HeaderConnection)`
	`157`	`+ return strings.EqualFold(upgrade, "websocket") && strings.Contains(strings.ToLower(connection), "upgrade")`
`157`	`158`	`}`
`158`	`159`
`159`	`160`	// Scheme returns the HTTP protocol scheme, `http` or `https`.