Summary

Forward Hono response headers to the WebSocket upgrade response so headers set by middleware (e.g. Set-Cookie, custom auth headers, WWW-Authenticate on reject) are no longer dropped during the handshake.

Previously, injectWebSocket discarded response.headers after init.app.request(...), so any header attached by Hono middleware never reached the client — both on successful upgrades and on rejected upgrades (4xx/5xx).

Changes

• On successful upgrade, response headers are appended via wss.on('headers', ...) (the official ws API for injecting handshake headers). The listener is removed in finally; headers is emitted synchronously inside handleUpgrade, so it cannot leak across concurrent upgrades.
• On rejected upgrade (no waiter / connectionSymbol mismatch), response headers are written into the manual socket.end(...) HTTP response.
• Skip hop-by-hop headers per RFC 9110 §7.6.1 (connection, keep-alive, proxy-authenticate, proxy-authorization, te, trailer, transfer-encoding, upgrade), plus framing (content-length) and WebSocket handshake headers managed by ws (sec-websocket-accept, sec-websocket-extensions, sec-websocket-protocol) to avoid corrupting the handshake.

Verification

• yarn workspace @hono/node-ws typecheck
• yarn workspace @hono/node-ws test run (15/15 passing, including 2 new tests)
• yarn prettier --check packages/node-ws/src/index.ts packages/node-ws/src/index.test.ts .changeset/polite-cooks-report.md

New tests cover:

• Custom response header set by middleware reaches the client on a successful upgrade.
• Custom response header is preserved on a rejected (401) upgrade response.