WebSockets & SSE
WebSocket upgrades and SSE streams are proxied end to end, over the same yamux stream that was opened for the original request, for as long as the connection stays open. Both the edge and the agent configure their httputil.ReverseProxy with FlushInterval: -1, so bytes reach the client as soon as they arrive instead of being batched.
WebSocket passthrough#
Go's stdlib httputil.ReverseProxy handles Connection: Upgrade on its own — hijacking the connection, completing the 101handshake, and copying bytes bidirectionally for the rest of the socket's life. That passthrough is now covered end to end by the e2e suite: a real 101 handshake with a multi-frame echo and a clean close.
WebSocket over HTTP/2#
Not enabled
Server-Sent Events#
SSE is plain HTTP streaming, not an upgrade — the response keeps status 200 and a Content-Type of text/event-stream, with bytes flushed to the client as they're written on the local app side. This is also covered by the e2e suite: a real SSE response with incremental delivery.
The upgrade budget#
A long-lived connection would otherwise hold a normal request slot — one of the global and per-session in-flight semaphores described in Limits & timeouts — for its entire life, which would starve ordinary HTTP requests behind it. The edge avoids that by watching for a long-lived response — 101 Switching Protocols, or a 200 whose Content-Type is text/event-stream— and moving it onto a separate upgrade budget the moment it's detected, releasing the request-scoped slot back to the pool.
When the upgrade budget is full#
A connection that can't be reclassified because the upgrade budget is exhausted is rejected, not silently downgraded or left on the request slot: the edge returns 503 Service Unavailable and increments ngstoned_rejected_upgrade_cap_total. ngstoned_active_upgrades is a live gauge of currently open upgraded connections, visible on the expvar ops endpoint.
Timeout behavior#
Long-lived, not unlimited
WriteTimeout, so a live stream is never cut off mid-flight by the HTTP server itself.101or an SSE response's headers arrive immediately in practice, so this timeout is not in the way once the stream is established.Access control applies too#
Source-IP allowlisting and HTTP basic auth are enforced beforethe upgrade happens, on the same request path as any other HTTP request. A gated tunnel's WebSocket and SSE traffic requires the same credentials or source IP as its plain HTTP traffic — there's no separate, unprotected path for upgrades. See Access control.
How they appear in the inspector#
The request inspector already understands WebSockets: an upgrade is finalized in the inspector at 101 time, not at close, so a long-lived connection shows up in the request list the instant it connects instead of staying invisible until the socket eventually closes. Rows for an open socket show WS in the method column and live byte counts in both directions in place of a duration.