# checklist-6455-server

tool: generate_checklist
args: {"rfc":6455,"sections":["5.1","5.2","5.3"],"role":"server"}

--- markdown ---
# RFC 6455 Implementation Checklist

**The WebSocket Protocol**

Role: server

Generated: <generatedAt>

## Mandatory Requirements (MUST / REQUIRED / SHALL)

- [ ] **MUST** The server MUST close the connection upon receiving a frame that is not masked. (§5.1)
- [ ] **MUST NOT** A server MUST NOT mask any frames that it sends to the client. (§5.1)
- [ ] **MUST** RSV1, RSV2, RSV3: 1 bit each MUST be 0 unless an extension is negotiated that defines meanings for non-zero values. (§5.2)
- [ ] **MUST** If a nonzero value is received and none of the negotiated extensions defines the meaning of such a nonzero value, the receiving endpoint MUST _Fail the WebSocket Connection_. (§5.2)
- [ ] **MUST** If an unknown opcode is received, the receiving endpoint MUST _Fail the WebSocket Connection_. (§5.2)
- [ ] **MUST** If 127, the following 8 bytes interpreted as a 64-bit unsigned integer (the most significant bit MUST be 0) are the payload length. (§5.2)
- [ ] **MUST** Note that in all cases, the minimal number of bytes MUST be used to encode the length, for example, the length of a 124-byte-long string can't be encoded as the sequence 126, 0, 124. (§5.2)
- [ ] **MUST** Any extension MUST specify the length of the "Extension data", or how that length may be calculated, and how the extension use MUST be negotiated during the opening handshake. (§5.2)
- [ ] **MUST** 1 bit in length, MUST be 0 unless negotiated otherwise (§5.2)
- [ ] **MUST** A masked frame MUST have the field frame-masked set to 1, as defined in Section 5.2. (§5.3)
- [ ] **MUST** The masking key needs to be unpredictable; thus, the masking key MUST be derived from a strong source of entropy, and the masking key for a given frame MUST NOT make it simple for a server/proxy to predict the masking key for a subsequent frame. (§5.3)
- [ ] **MUST NOT** The masking key needs to be unpredictable; thus, the masking key MUST be derived from a strong source of entropy, and the masking key for a given frame MUST NOT make it simple for a server/proxy to predict the masking key for a subsequent frame. (§5.3)

## Optional Requirements (MAY / OPTIONAL)

- [ ] **MAY** (Note that masking is done whether or not the WebSocket Protocol is running over TLS.) The server MUST close the connection upon receiving a frame that is not masked. In this case, a server MAY send a Close frame with a status code of 1002 (protocol error) as defined in Section 7.4.1. (§5.1)
- [ ] **MAY** A data frame MAY be transmitted by either the client or the server at any time after opening handshake completion and before that endpoint has sent a Close frame (Section 5.5.1). (§5.1)
- [ ] **MAY** The first fragment MAY also be the final fragment. (§5.2)

--- json ---
{
  "rfc": 6455,
  "role": "server",
  "stats": {
    "must": 12,
    "should": 0,
    "may": 3,
    "total": 15
  },
  "_source": "text",
  "_sourceNote": "Warning: Parsed from text format. Checklist accuracy may be limited."
}