diff --git a/transport/internet/httpupgrade/dialer.go b/transport/internet/httpupgrade/dialer.go
index d05ae8f47..cf244b38d 100644
--- a/transport/internet/httpupgrade/dialer.go
+++ b/transport/internet/httpupgrade/dialer.go
@@ -3,6 +3,8 @@ package httpupgrade
 import (
 	"bufio"
 	"context"
+	"crypto/rand"
+	"encoding/base64"
 	"net/http"
 	"net/url"
 	"strings"
@@ -97,6 +99,16 @@ func dialhttpUpgrade(ctx context.Context, dest net.Destination, streamSettings *
 	req.Header.Set("Connection", "Upgrade")
 	req.Header.Set("Upgrade", "websocket")
 
+	// make a valid Sec-WebSocket-Key if not present
+	if len(req.Header.Values("Sec-WebSocket-Key")) == 0 {
+		var buf [16]byte
+		rand.Read(buf[:])
+		req.Header.Set("Sec-WebSocket-Key", base64.StdEncoding.EncodeToString(buf[:]))
+	}
+	if len(req.Header.Values("Sec-WebSocket-Version")) == 0 {
+		req.Header.Set("Sec-WebSocket-Version", "13")
+	}
+
 	err = req.Write(conn)
 	if err != nil {
 		return nil, err
diff --git a/transport/internet/httpupgrade/hub.go b/transport/internet/httpupgrade/hub.go
index 9a6429447..2e968840a 100644
--- a/transport/internet/httpupgrade/hub.go
+++ b/transport/internet/httpupgrade/hub.go
@@ -3,7 +3,9 @@ package httpupgrade
 import (
 	"bufio"
 	"context"
+	"crypto/sha1"
 	"crypto/tls"
+	"encoding/base64"
 	"io"
 	"net/http"
 	"strings"
@@ -81,6 +83,11 @@ func (s *server) upgrade(conn net.Conn) (stat.Connection, error) {
 	}
 	resp.Header.Set("Connection", "Upgrade")
 	resp.Header.Set("Upgrade", "websocket")
+	// respond a valid Sec-WebSocket-Accept header if received a Sec-WebSocket-Key
+	if wsKey := req.Header.Get("Sec-WebSocket-Key"); wsKey != "" {
+		acceptKey := sha1.Sum([]byte(wsKey + "258EAFA5-E914-47DA-95CA-C5AB0DC85B11")) // magic number in RFC 6455
+		resp.Header.Set("Sec-WebSocket-Accept", base64.StdEncoding.EncodeToString(acceptKey[:]))
+	}
 	err = resp.Write(conn)
 	if err != nil {
 		return nil, err