mirror of
https://github.com/caddyserver/caddy.git
synced 2026-11-11 19:37:55 +00:00
When downgrading an HTTP/2 or HTTP/3 extended CONNECT WebSocket request to HTTP/1.1, delete any parsed client-supplied Sec-WebSocket-Key header prior to installing Caddy's generated 16-byte random key. This prevents request header operations from canonicalizing and combining both keys into duplicate Sec-WebSocket-Key headers upstream. Signed-off-by: duongynhi000005-oss <duongynhi000005@gmail.com>