Q:

Disabling WebSockets compression and xor mask on the Browser side

I use "WS" library in my NodeJS project. It is possible to disable compression? I'm trying to do this on the server side
ws = new WebSocketServer({port: 8889, perMessageDeflate: false})

but it does not work
Accept-Encoding: gzip, deflate
Sec-WebSocket-Extensions: permessage-deflate

And I have no idea what can i do to disable xor mask.

A:

You have disabled per message deflate in the server, however you are seeing that the client is announcing its capability of handling it, this is normal. I mean, that HTTP headers you have pasted are from the client request (because a server does not send Accept-* headers).
To know if compression was finally selected as extension for the connection, check the Sec-WebSocket-Extensions header in the server response.
XOR masking cannot be disabled, it is required from client to browser to mitigate some possible attacks and proxies doing funny things: https://softwareengineering.stackexchange.com/questions/226343/is-masking-really-necessary-when-sending-from-websocket-client

