CLOUD CONCEPT

WebSockets

WebSockets is a communication protocol that enables persistent, bidirectional message exchange between a client and a server over a single connection.

Cloud Concepts Hub →

What is WebSockets

Unlike ordinary HTTP request-response exchanges, a WebSocket connection lets either endpoint send messages without waiting for a new request. This makes it useful for interactive AI applications, live notifications, and collaborative systems where low-latency updates and client commands must flow continuously.

WebSockets provides a persistent, full-duplex communication channel: the client and server can independently send messages over an established connection. In a typical HTTP/1.1 deployment, the client starts with an HTTP upgrade handshake, after which communication uses WebSocket frames rather than ordinary HTTP request-response messages. Production applications normally use wss://, which protects the connection with TLS. WebSockets supports text and binary messages; application code defines their meaning.

In cloud applications, a managed WebSocket gateway or a load balancer in front of application servers accepts connections and routes traffic. A managed gateway can retain the client connection while invoking short-lived backend handlers for individual messages. This means a persistent client connection does not necessarily require a continuously running function. With self-managed servers, engineers must instead manage connection capacity, draining during deployments, and routing updates to the server holding each connection.

A practical generative AI workflow begins when a browser sends a prompt with a request identifier over its WebSocket connection. A backend worker calls a foundation model streaming API, such as Amazon Bedrock ConverseStream or InvokeModelWithResponseStream, and reads incremental output events. The worker translates those events into application messages containing text deltas, sequence numbers, and the request identifier. It sends an explicit completion or error message when generation ends. Streaming improves perceived responsiveness and time to first visible output; it does not necessarily reduce total generation time.

The model stream and the client connection are separate interfaces. Bedrock streaming responses are not browser WebSocket connections, and a gateway does not automatically translate model events into client messages. A backend must perform that adaptation, preserve relevant metadata, and handle errors after partial output has already reached the user. Clients can send cancellation commands over the same channel, but the application must implement cancellation and stop upstream generation where supported.

WebSockets, server-sent events, and HTTP response streaming are related alternatives, not interchangeable protocols. Server-sent events delivers server-to-client text events over HTTP and is often simpler when the browser only needs generated text updates; prompts can arrive through separate HTTP requests. WebSockets is useful when the same channel must also carry frequent client commands or interactive events. HTTP/1.1 chunked transfer encoding frames an HTTP response of initially unknown length; it does not create a WebSocket connection. When using API Gateway for HTTP response streaming, select an API type and integration that explicitly support streaming rather than assuming every gateway integration forwards chunks immediately. HTTP/2 uses its own framing rather than HTTP/1.1 chunked transfer encoding.

Reliability requires application-level design. Message order is preserved on a live connection, but reconnecting does not automatically replay missed output or guarantee exactly-once processing. Use request identifiers, sequence numbers, bounded replay buffers when needed, and retry-safe handlers. Apply bounded queues and output batching so slow clients do not cause unlimited memory growth. Respect connection lifetimes, idle timeouts, message-size limits, and gateway quotas, and reconnect with exponential backoff and jitter.

Authenticate connection establishment and authorize each sensitive action against the current user and tenant. Validate browser origins, message schemas, and payload sizes; do not treat an open connection as permanent authorization. Avoid exposing cloud credentials to browsers. Monitor connection failures, time to first output, inter-message latency, delivery errors, and abandoned generations. Consider connection-duration and message charges alongside backend inference costs when choosing between WebSockets and simpler one-way streaming.

Key aspects of WebSockets

WebSockets enables low-latency bidirectional messaging, but applications must explicitly manage streaming adaptation, security, flow control, and recovery.

Persistent, full-duplex communication

Either endpoint can send messages over an established connection without starting another HTTP request. This supports generated output alongside client actions such as cancellation or interactive edits.

Explicit streaming adaptation

A backend converts foundation model streaming events into the application's WebSocket message format. Include request identifiers, output deltas, and explicit completion and error messages.

Application-level delivery guarantees

A live connection preserves message order, but reconnects do not provide automatic replay or exactly-once processing. Sequence numbers, acknowledgments where needed, and retry-safe processing address these gaps.

Connection lifecycle and flow control

Plan for idle timeouts, maximum connection durations, disconnects, and slow consumers. Bounded queues, batching, heartbeats where supported, and controlled reconnects prevent resource exhaustion.

Security beyond the handshake

Use TLS, authenticate connection establishment, and authorize sensitive messages throughout the session. Validate browser origins and enforce tenant isolation when mapping users to connection identifiers.

Transport selection

Choose WebSockets for bidirectional interaction and consider server-sent events or HTTP response streaming for primarily one-way output. HTTP chunked transfer encoding is response framing, not a synonym for WebSockets.

Cloud services for WebSockets

A common serverless design uses Amazon API Gateway to maintain WebSocket connections, AWS Lambda to process connection events and prompts, and Amazon DynamoDB to associate authenticated users with connection identifiers. A backend consumes Amazon Bedrock streaming output and pushes application messages through the gateway's Management API. Connection cleanup, tenant authorization, cancellation, and partial-response errors remain application responsibilities.

For applications that need direct control of connection servers, Application Load Balancer can front a fleet of WebSocket-capable application instances instead of a managed WebSocket gateway. In either design, the model's streaming interface and the client-facing transport remain separate, and engineers must account for buffering, timeouts, quotas, and slow consumers.

Amazon API Gateway image Amazon API Gateway

WebSocket APIs manage client connections and route incoming messages to backend integrations. Backends push messages to specific connections through the API Gateway Management API; this is distinct from configuring HTTP response streaming.

Open Amazon API Gateway →
Amazon Bedrock

ConverseStream and InvokeModelWithResponseStream provide incremental model output for supported models. A backend consumes these events and forwards appropriate deltas and status messages over the application's WebSocket channel.

Open Amazon Bedrock →
AWS Lambda image AWS Lambda

Lambda functions can handle connection events and client messages from API Gateway and send responses through its Management API. A function can also consume and forward model output within its execution limits; it does not need to remain running simply to keep the gateway connection open.

Open AWS Lambda →
Amazon DynamoDB image Amazon DynamoDB

DynamoDB can store user-to-connection mappings, subscription metadata, and request state for distributed message delivery. Remove stale connections when delivery fails, and do not assume disconnect handlers or TTL expiration provide immediate cleanup.

Open Amazon DynamoDB →