I use "WS" library in my NodeJS project. It is possible to disable pression? I'm trying to do this on the server side

ws = new WebSocketServer({port: 8889, perMessageDeflate: false})

but it does not work

Accept-Encoding: gzip, deflate
Sec-WebSocket-Extensions: permessage-deflate

And I have no idea what can i do to disable xor mask.

I use "WS" library in my NodeJS project. It is possible to disable pression? I'm trying to do this on the server side

ws = new WebSocketServer({port: 8889, perMessageDeflate: false})

but it does not work

Accept-Encoding: gzip, deflate
Sec-WebSocket-Extensions: permessage-deflate

And I have no idea what can i do to disable xor mask.

• javascript
• node.js
• websocket

• if you don't want to use pression extension, you should disable it from client side! – damphat Commented Oct 25, 2015 at 10:50
• 1 The client is a browser in my case. I do not know how to disable it on the browser side. – ldp.n Commented Oct 25, 2015 at 11:00

2 Answers 2

You have disabled per message deflate in the server, however you are seeing that the client is announcing its capability of handling it, this is normal. I mean, that HTTP headers you have pasted are from the client request (because a server does not send Accept-* headers).

To know if pression was finally selected as extension for the connection, check the Sec-WebSocket-Extensions header in the server response.

XOR masking cannot be disabled, it is required from client to browser to mitigate some possible attacks and proxies doing funny things: https://softwareengineering.stackexchange./questions/226343/is-masking-really-necessary-when-sending-from-websocket-client

Don't forget to add the Compression: None header — otherwise, the browser requires Sec-WebSocket-Extensions with permessage-deflate.