apache / apache/shenyu

[BUG] WebSocket Upgrade header detection is case-sensitive, violating RFC 6455

Open Beginner friendly
#6,556 1 comment 0 reactions 0 assignees View on GitHub
plugin: websocket priority: medium type: bug
Dominant language
Java
Stars
8.8k
Forks
3.1k
Avg merge
7d 1h
Merged PRs (30d)
85

Description

## Description
`String upgrade = headers.getFirst(UPGRADE); if (StringUtils.isNotEmpty(upgrade) && RpcTypeEnum.WEB_SOCKET.getName().equals(upgrade))`. `RpcTypeEnum.WEB_SOCKET.getName()` is the lowercase literal `"websocket"` and the comparison is case-sensitive. RFC 6455 4.2.1/4.1 requires the `Upgrade` header value to be compared case-insensitively. A client sending `Upgrade: WebSocket` or `Upgrade: WEBSOCKET` fails the check, so `rpcType` defaults to `HTTP`.

## Location
```
shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75
```

## Impact
Standards-compliant WebSocket clients that emit a non-lowercase `Upgrade` value fail to be proxied as WebSocket; `WebSocketPlugin.skip()` returns `true` and the upgrade handshake is not proxied. Most browsers send lowercase so impact is limited to non-browser/edge clients; still a real correctness deviation.

## Suggested fix
Use `equalsIgnoreCase`, e.g. `RpcTypeEnum.WEB_SOCKET.getName().equalsIgnoreCase(upgrade)`.

## Related existing issue(s)
None

_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._

Contributor guide

No contributing guide indexed for this repository

Research direction

Start at shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75, where the Upgrade header is compared, and trace how WebSocketPlugin.skip() uses the resulting rpcType. Make Upgrade value matching accept the RFC-required capitalization variants, then verify that WebSocket clients using WebSocket or WEBSOCKET are proxied as WebSocket rather than treated as HTTP.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
api, backend, networking
Issue type
Bug
Difficulty
1/5
Estimated time
Under an hour
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
88/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.