Apranik

HTTPUpgrade ​

An overlay: the HTTP/1.1 upgrade handshake, then raw bytes with no WebSocket framing. It passes CDNs that relay an upgraded connection without checking frames, such as Cloudflare, and costs nothing after the handshake. Compatible with Xray's and sing-box's. A tls below it must set "alpn": ["http/1.1"].

What ws and httpupgrade put on the wire

Structure ​

json
{
  "type": "httpupgrade",
  "settings": {
    "path": "/up",
    "host": "cdn.example.com",
    "accept_websocket_key": true
  }
}

Fields ​

path ​

stringDefault: /

The request path. A server ignores the query string and answers any other path with 404.

host ​

string

Outbound: the Host header a CDN routes on; default the outbound's server. Inbound: the only Host accepted; default any.

headers ​

object of stringsoutbound

Extra request headers. Without a User-Agent, a browser's is sent.

pipeline ​

booleanDefault: falseoutbound

Send the payload without waiting for the server's 101, saving a round trip. Only safe against an Apranik server. Xray's and sing-box's servers may drop those bytes (not tested).

original_source_ip ​

objectinbound

Reads the client's address from a header the CDN adds. See Client address behind a proxy.

accept_websocket_key ​

booleanDefault: trueinbound

Accept a request carrying Sec-WebSocket-Key, as Xray does. false answers it with 404, as sing-box does.

handshake_timeout ​

durationDefault: 10s

How long the upgrade may take.