From fde5c3e498c357e3bae3f8f8019d0d872aad63da Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:35 +0200
Subject: [PATCH 1/4] Parse HTTP header lists using OWS

---
 lib/websocket/driver.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/websocket/driver.rb b/lib/websocket/driver.rb
index 586f6a6..455e700 100644
--- a/lib/websocket/driver.rb
+++ b/lib/websocket/driver.rb
@@ -240,7 +240,7 @@ def self.websocket?(env)
       upgrade    = env['HTTP_UPGRADE']    || ''
 
       env['REQUEST_METHOD'] == 'GET' and
-      connection.downcase.split(/ *, */).include?('upgrade') and
+      connection.downcase.split(/[ \t]*,[ \t]*/).include?('upgrade') and
       upgrade.downcase == 'websocket'
     end
 

From 906f2163ecd332493fb20d9a502b9dddfb89b0b5 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:36 +0200
Subject: [PATCH 2/4] Parse HTTP header lists using OWS

---
 lib/websocket/driver/client.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/websocket/driver/client.rb b/lib/websocket/driver/client.rb
index fadda79..0b92620 100644
--- a/lib/websocket/driver/client.rb
+++ b/lib/websocket/driver/client.rb
@@ -111,7 +111,7 @@ def validate_handshake
 
         if connection == ''
           return fail_handshake("'Connection' header is missing")
-        elsif connection.downcase != 'upgrade'
+        elsif !connection.downcase.split(/[ \t]*,[ \t]*/).include?('upgrade')
           return fail_handshake("'Connection' header value is not 'Upgrade'")
         end
 

From e1fe6f0c1c2da862ce250a4683c7a233b92ac1ea Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:38 +0200
Subject: [PATCH 3/4] Parse HTTP header lists using OWS

---
 lib/websocket/driver/hybi.rb | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/lib/websocket/driver/hybi.rb b/lib/websocket/driver/hybi.rb
index 3487c4a..20c3e66 100644
--- a/lib/websocket/driver/hybi.rb
+++ b/lib/websocket/driver/hybi.rb
@@ -63,7 +63,7 @@ def initialize(socket, options = {})
         @stage           = 0
         @masking         = options[:masking]
         @protocols       = options[:protocols] || []
-        @protocols       = @protocols.strip.split(/ *, */) if String === @protocols
+        @protocols       = @protocols.strip.split(/[ \t]*,[ \t]*/) if String === @protocols
         @require_masking = options[:require_masking]
         @ping_callbacks  = {}
 
@@ -72,7 +72,7 @@ def initialize(socket, options = {})
         return unless @socket.respond_to?(:env)
 
         if protos = @socket.env['HTTP_SEC_WEBSOCKET_PROTOCOL']
-          protos = protos.split(/ *, */) if String === protos
+          protos = protos.split(/[ \t]*,[ \t]*/) if String === protos
           @protocol = protos.find { |p| @protocols.include?(p) }
         else
           @protocol = nil

From 469301b79493b1c86c65c21c5604be3c3ed17ef4 Mon Sep 17 00:00:00 2001
From: Oskar Eichler <62393985+OskarEichler@users.noreply.github.com>
Date: Sun, 30 Aug 2026 04:50:40 +0200
Subject: [PATCH 4/4] Parse HTTP header lists using OWS

---
 lib/websocket/http/headers.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/websocket/http/headers.rb b/lib/websocket/http/headers.rb
index cfe937c..204711c 100644
--- a/lib/websocket/http/headers.rb
+++ b/lib/websocket/http/headers.rb
@@ -33,7 +33,7 @@ module Headers
       #                      / DIGIT / ALPHA
       #                      ; any VCHAR, except delimiters
 
-      HEADER_LINE = /^([!#\$%&'\*\+\-\.\^_`\|~0-9a-z]+):\s*([\x20-\x7e]*?)\s*$/i
+      HEADER_LINE = /^([!#\$%&'\*\+\-\.\^_`\|~0-9a-z]+):\s*([\x09\x20-\x7e]*?)\s*$/i
 
       attr_reader :headers