I don’t see the security problem. Everything looks like it’s operating correctly. If you don’t want to accept a WebSocket handshake then just drop the socket at your security layer if it contains the required Sec-Websocket-Key header.