The HTTP Upgrade header is hop-by-hop only and therefore removed by a reverse proxy. Read more: http://nginx.org/en/docs/http/websocket.html