fix: prevent duplicate Sec-WebSocket-Protocol header

websocket-client library merges header dict entries with the subprotocols
parameter into a single comma-joined value (e.g. 'awap,awap,awap'),
causing ACS3 signature verification to fail on the server side.

Author: weeping

darabonba/websocket.py

@@ -208,10 +208,12 @@ def connect(self, request: DaraRequest, runtime_object: Any) -> DaraResponse:
                 if value and key.lower() not in ('host', 'content-length'):
                     headers[key] = value
 
-        if self.websocket_sub_protocol:
+        if self.websocket_sub_protocol and not any(
+            k.lower() == 'sec-websocket-protocol' for k in headers
+        ):
             headers['Sec-WebSocket-Protocol'] = self.websocket_sub_protocol
 
-        subprotocols = [self.websocket_sub_protocol] if self.websocket_sub_protocol else None
+        subprotocols = None
         sslopt = self._configure_tls(runtime_object, parsed.scheme)
         proxy_kwargs = self._configure_proxy(parsed, runtime_object, request)
 

tests/test_websocket.py

@@ -347,6 +347,51 @@ def test_configure_http_proxy(self):
         )
         self.assertIn('Proxy-Authorization', auth_request.headers)
 
+    def test_no_duplicate_sec_websocket_protocol_header(self):
+        captured = {}
+        original_init = __import__('websocket').WebSocketApp.__init__
+
+        def patched_init(self_app, url, header=None, on_open=None,
+                         on_message=None, on_error=None, on_close=None,
+                         subprotocols=None, **kwargs):
+            captured['header'] = header
+            captured['subprotocols'] = subprotocols
+            raise ConnectionRefusedError('captured')
+
+        import websocket as ws_lib
+        ws_lib.WebSocketApp.__init__ = patched_init
+        try:
+            request = DaraRequest()
+            request.protocol = 'ws'
+            request.domain = '127.0.0.1:19999'
+            request.pathname = '/'
+            request.headers = {
+                'host': '127.0.0.1:19999',
+                'sec-websocket-protocol': 'awap',
+            }
+
+            runtime = RuntimeOptions(
+                connect_timeout=5000,
+                read_timeout=5000,
+                web_socket_ping_interval=0,
+                web_socket_enable_reconnect=False,
+                websocket_sub_protocol='awap',
+            )
+            handler = MockWebSocketHandler()
+            client = new_default_websocket_client(handler)
+            try:
+                client.connect(request, runtime)
+            except (ConnectionRefusedError, Exception):
+                pass
+
+            header = captured.get('header', {})
+            protocol_keys = [k for k in header if k.lower() == 'sec-websocket-protocol']
+            self.assertEqual(1, len(protocol_keys),
+                             f'Expected exactly 1 protocol header, got: {protocol_keys}')
+            self.assertIsNone(captured.get('subprotocols'))
+        finally:
+            ws_lib.WebSocketApp.__init__ = original_init
+
 
 if __name__ == '__main__':
     unittest.main()