Missing Sec-WebSocket-Accept response header over HTTPS for React Native iOS

[lambdam]

Hello,

I'm building a React Native application with ClojureScript (re-natal) and use Sente for websockets.

I managed to have it working on production for Android but not for iOS. The error message I managed to get with a remote Chrome debugger on dev is "Invalid Sec-WebSocket-Accept response".

I looked for information and found those pages :

• https://tools.ietf.org/html/rfc6455#section-4.2.2
• https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_servers#Server_handshake_response

I logged the requests/responses of my server (Aleph based) and saw that this header was missing in the response. I was also a bit surprised by the absence of :status 101 field in the response (is it on purpose?)

I'm still looking for information and hacking to manually include the header :

(defn wrap-websocket-sec-header [handler]
  (fn set-websocket-sec-header [request]
    (dfrd/let-flow [response (handler request)]
      (if-let [sec-key (get-in request [:headers "sec-websocket-key"])]
        (let [magic-string "258EAFA5-E914-47DA-95CA-C5AB0DC85B11"
              accept-key (-> (str sec-key magic-string)
                             hash/sha1
                             base64/encode
                             codecs/bytes->str)]
          (assoc-in response [:headers "sec-websocket-accept"] accept-key))
        response))))

but couldn't have the handshake to work on iOS until now.

Still, by browsing sente source code, I didn't see any part that seems to handle the Sec-WebSocket-Key request header and produce the Sec-WebSocket-Accept.

Thanks for all the great work.

[ptaoussanis]

@lambdam Hi Damien, apologies for the long delay replying!

If I understand your question correctly, Sec-WebSocket-Key and Sec-WebSocket-Accept are handled by the underlying HTTP server, and not Sente itself.

Here is the relevant http-kit code, for example.

I'm not familiar with Aleph, sorry!

Hope that's of some help?

Closing for now as part of issue triage, but please feel free to re-open if this issue is still relevant!