[BUG] WebSocket Upgrade header detection is case-sensitive, violating RFC 6455
- Dominant language
- Java
- Stars
- 8.8k
- Forks
- 3.1k
- Avg merge
- 7d 1h
- Merged PRs (30d)
- 85
Description
## Description
`String upgrade = headers.getFirst(UPGRADE); if (StringUtils.isNotEmpty(upgrade) && RpcTypeEnum.WEB_SOCKET.getName().equals(upgrade))`. `RpcTypeEnum.WEB_SOCKET.getName()` is the lowercase literal `"websocket"` and the comparison is case-sensitive. RFC 6455 4.2.1/4.1 requires the `Upgrade` header value to be compared case-insensitively. A client sending `Upgrade: WebSocket` or `Upgrade: WEBSOCKET` fails the check, so `rpcType` defaults to `HTTP`.
## Location
```
shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75
```
## Impact
Standards-compliant WebSocket clients that emit a non-lowercase `Upgrade` value fail to be proxied as WebSocket; `WebSocketPlugin.skip()` returns `true` and the upgrade handshake is not proxied. Most browsers send lowercase so impact is limited to non-browser/edge clients; still a real correctness deviation.
## Suggested fix
Use `equalsIgnoreCase`, e.g. `RpcTypeEnum.WEB_SOCKET.getName().equalsIgnoreCase(upgrade)`.
## Related existing issue(s)
None
_Identified during the 2026-08-02 audit; full list in [`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._
Contributor guide
No contributing guide indexed for this repository
Research direction
Start at shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75, where the Upgrade header is compared, and trace how WebSocketPlugin.skip() uses the resulting rpcType. Make Upgrade value matching accept the RFC-required capitalization variants, then verify that WebSocket clients using WebSocket or WEBSOCKET are proxied as WebSocket rather than treated as HTTP.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- api, backend, networking
- Issue type
- Bug
- Difficulty
- 1/5
- Estimated time
- Under an hour
- Activity status
- Quiet
- Clarity
- Clearly specified
- Newbie friendliness
- 88/100