[BUG] WebSocket Upgrade header detection is case-sensitive, violating RFC 6455

[Aias00]

Description

String upgrade = headers.getFirst(UPGRADE); if (StringUtils.isNotEmpty(upgrade) && RpcTypeEnum.WEB_SOCKET.getName().equals(upgrade)). RpcTypeEnum.WEB_SOCKET.getName() is the lowercase literal "websocket" and the comparison is case-sensitive. RFC 6455 4.2.1/4.1 requires the Upgrade header value to be compared case-insensitively. A client sending Upgrade: WebSocket or Upgrade: WEBSOCKET fails the check, so rpcType defaults to HTTP.

Location

shenyu-plugin-global/.../DefaultShenyuContextBuilder.java:72-75

Impact

Standards-compliant WebSocket clients that emit a non-lowercase Upgrade value fail to be proxied as WebSocket; WebSocketPlugin.skip() returns true and the upgrade handshake is not proxied. Most browsers send lowercase so impact is limited to non-browser/edge clients; still a real correctness deviation.

Suggested fix

Use equalsIgnoreCase, e.g. RpcTypeEnum.WEB_SOCKET.getName().equalsIgnoreCase(upgrade).

Related existing issue(s)

None

Identified during the 2026-08-02 audit; full list in docs/issue-candidates-2026-08-02.md.

[github-actions]

👋 Hello @Aias00

A new issue has been opened by @Aias00:

• Title: [BUG] WebSocket Upgrade header detection is case-sensitive, violating RFC 6455
• Link: [BUG] WebSocket Upgrade header detection is case-sensitive, violating RFC 6455 #6556

Please review when you have time. Thank you! 🙏