MQTT over WebSocket
subprotocolRFC 6455MQTT over WebSocket uses the WebSocket subprotocol identifier mqtt to tunnel MQTT binary frames inside WebSocket frames. Negotiated via Sec-WebSocket-Protocol: mqtt in the handshake. Required when MQTT clients (IoT devices, browsers) run in environments that only support WebSocket connections (port 80/443). AWS IoT Core, HiveMQ, and Mosquitto all support MQTT over WebSocket on port 443.
Details
WebSocket subprotocols provide application-level multiplexing over a single WebSocket connection.
Subprotocol negotiation: The client lists subprotocols it supports in Sec-WebSocket-Protocol (comma-separated). The server selects one and echoes it in the response Sec-WebSocket-Protocol header. If the server cannot support any proposed subprotocol, it can accept the connection without the header, but well-behaved servers reject connections for unknown required subprotocols.
MQTT-specific details: IANA-registered subprotocol: mqtt (MQTT 3.1.1 and 5.0) MQTT binary frames are placed directly as WebSocket binary message payloads. MQTT QoS semantics (0/1/2) operate at the MQTT layer; WebSocket provides reliable delivery. Port: 443 (wss://) is standard for browser MQTT clients. Port 8883 is MQTT over direct TLS without WebSocket.
Common brokers: AWS IoT Core: wss://endpoint.iot.region.amazonaws.com/mqtt (SigV4 auth in URL) HiveMQ: wss://broker.hivemq.com:8884/mqtt Mosquitto: configure listener port with protocol websockets
Handshake example
# MQTT over WebSocket handshake GET /mqtt HTTP/1.1 Host: broker.example.com Upgrade: websocket Connection: Upgrade Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ== Sec-WebSocket-Version: 13 Sec-WebSocket-Protocol: mqtt # Server response (selects mqtt subprotocol) HTTP/1.1 101 Switching Protocols Upgrade: websocket Connection: Upgrade Sec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo= Sec-WebSocket-Protocol: mqtt # After handshake: MQTT CONNECT packet sent as WebSocket binary frame # (MQTT frame structure unchanged – WebSocket is purely the transport)