WebSocket 'Error during WebSocket handshake: Unexpected response code: 400' (or 404, 426) when connecting through Nginx or a load balancer; works directly against the app. How do I fix it?

Cause: a WebSocket starts as an HTTP/1.1 GET that asks to switch protocols (Connection: Upgrade, Upgrade: websocket, plus Sec-WebSocket headers). The server must answer 101 Switching Protocols. If a proxy drops those hop-by-hop headers, talks HTTP/1.0, or routes the path to the wrong backend, the app sees an ordinary request and replies 400/404 (or 200), and the browser reports an unexpected response code. The upgrade mechanism is HTTP/1.1 only; it is not used over HTTP/2. Fix: 1. Nginx: Upgrade and Connection are not forwarded by default, so set them explicitly in the location that proxies the socket: proxy_pass http://backend; proxy_http_version 1.1; (needed on older nginx; the docs say it is required before 1.29.7) proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection "upgrade"; A map on $http_upgrade lets one location serve both normal and WebSocket requests. 2. Idle disconnects: Nginx closes the proxied connection after 60 seconds without data by default (proxy_read_timeout). Raise it or have the app send periodic ping frames. 3. AWS Application Load Balancer supports WebSockets natively on HTTP and HTTPS listeners, with no special switch. Its connection idle timeout defaults to 60 seconds, so send application-level keepalives or raise the timeout (aws elbv2 modify-load-balancer-attributes with idle_timeout.timeout_seconds). Target groups with target optimizer enabled do not support WebSockets. 4. Check the path, the Host header and any path rewriting: the proxy rule must match the socket URL (for example /socket.io/ or /ws). 5. Use wss:// to match an HTTPS page; make sure TLS terminates on a proxy that handles the upgrade. 6. Multi-instance libraries that fall back to long polling may need sticky sessions; check your library's docs. Verify: in DevTools > Network (WS filter) the request shows status 101 Switching Protocols, messages flow, and the connection stays open past the proxy's idle timeout. Sources: https://nginx.org/en/docs/http/websocket.html https://docs.aws.amazon.com/elasticloadbalancing/latest/application/load-balancer-listeners.html https://docs.aws.amazon.com/elasticloadbalancing/latest/application/edit-load-balancer-attributes.html https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Protocol_upgrade_mechanism