Aias00 opened a new issue, #6556:
URL: https://github.com/apache/shenyu/issues/6556

   ## Description
   `String upgrade = headers.getFirst(UPGRADE); if 
(StringUtils.isNotEmpty(upgrade) && 
RpcTypeEnum.WEB_SOCKET.getName().equals(upgrade))`. 
`RpcTypeEnum.WEB_SOCKET.getName()` is the lowercase literal `"websocket"` and 
the comparison is case-sensitive. RFC 6455 4.2.1/4.1 requires the `Upgrade` 
header value to be compared case-insensitively. A client sending `Upgrade: 
WebSocket` or `Upgrade: WEBSOCKET` fails the check, so `rpcType` defaults to 
`HTTP`.
   
   ## Location
   ```
   shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75
   ```
   
   ## Impact
   Standards-compliant WebSocket clients that emit a non-lowercase `Upgrade` 
value fail to be proxied as WebSocket; `WebSocketPlugin.skip()` returns `true` 
and the upgrade handshake is not proxied. Most browsers send lowercase so 
impact is limited to non-browser/edge clients; still a real correctness 
deviation.
   
   ## Suggested fix
   Use `equalsIgnoreCase`, e.g. 
`RpcTypeEnum.WEB_SOCKET.getName().equalsIgnoreCase(upgrade)`.
   
   ## Related existing issue(s)
   None
   
   _Identified during the 2026-08-02 audit; full list in 
[`docs/issue-candidates-2026-08-02.md`](docs/issue-candidates-2026-08-02.md)._


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to