Goa websocket with subprotocols (auth)

upgrader := &websocket.Upgrader{}
upgrader.CheckOrigin = func(r *http.Request) bool { return true } // setup authorised origins; this is a demo

// You have to tell it that Sec-Websocket-Protocol and your custom auth header are valid subprotocols
// or it won't work! and you will get an error like this:
// Error during WebSocket handshake: Sent non-empty 'Sec-WebSocket-Protocol' header but no response was received
upgrader.Subprotocols = []string{"Sec-Websocket-Protocol", "x-api-key"}

// set custom context keys
type xApiKeyWSType string
const apiKeyCtxKey xApiKeyWSType = "x-api-key"

func WebsocketConnection() func(http.Handler) http.Handler {
	return func(h http.Handler) http.Handler {
		return http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
			req := r
            // if not a websocket connection, continue
			if upgrade := r.Header.Get("Connection"); upgrade != "Upgrade" {
				// Not a websocket connection
				h.ServeHTTP(w, req)
			}
            // Get the header with the key
			if auth := r.Header.Get("Sec-WebSocket-Protocol"); auth != "" {
                // the header will return a string: x-api-key, key_000000000000
                // we need to split, then trim white space
				header := strings.Split(auth, ",")
				header[1] = strings.TrimSpace(header[1])
				ctx := context.WithValue(r.Context(), apiKeyCtxKey, header[1])
				req = r.WithContext(ctx)
			}
			h.ServeHTTP(w, req)
		})
	}
}

func (a *ApiKey) Validate(
	ctx context.Context,
	key string,
	scheme *security.APIKeyScheme,
	db *repository.Queries,
) (context.Context, error) {
	if key == "" {
		key = GetXApiKeyWS(ctx)
	}
    // truncated but do something with the key.
    // a typical HTTP request will have the key available already but
    // we need to grab it via the GetXApiKeyWS function
	return ctx, nil
}