What is Sec-WebSocket-Key for? -

in section 1.3 "opening handshake" of draft-ietf-hybi-thewebsocketprotocol-17, describes sec-websocket-key follows:

to prove handshake received, server has take 2 pieces of information , combine them form response. first piece of information comes |sec-websocket-key| header field in client handshake:

sec-websocket-key: dghlihnhbxbszsbub25jzq== 

for header field, server has take value (as present in header field, e.g. base64-encoded [rfc4648] version minus leading , trailing whitespace), , concatenate globally unique identifier (guid, [rfc4122]) "258eafa5-e914-47da-95ca-c5ab0dc85b11" in string form, unlikely used network endpoints not understand websocket protocol. sha-1 hash (160 bits), base64-encoded (see section 4 of [rfc4648]), of concatenation returned in server's handshake [fips.180-2.2002].

here's thing can't understand: why not return code 101? if proper use of sec-websocket-key security, or prove can handle websocket requests, server return expected key if wanted to, , pretend websocket server.

according rfc 6455 websocket standard

first part:

.. server has prove client received client's websocket handshake, server doesn't accept connections not websocket connections.  prevents attacker tricking websocket server sending crafted packets using xmlhttprequest [xmlhttprequest] or form submission.  ... header field, server has take value (as present in header field, e.g., base64-encoded [rfc4648] version minus leading , trailing whitespace) , concatenate globally unique identifier (guid, [rfc4122]) "258eafa5-e914-47da- 95ca-c5ab0dc85b11" in string form, unlikely used network endpoints not understand websocket protocol. 

second part:

the |sec-websocket-key| header field used in websocket opening handshake.  sent client server provide part of information used server prove received valid websocket opening handshake.  helps ensure server not accept connections non-websocket clients (e.g., http clients) being abused send data unsuspecting websocket servers. 

so, value of guid specified in standard, unlikely (possible, put small probability) server not aware of websockets use it. not provide security (secure websockets - wss:// - does), ensures server understands websockets protocol.

really, you've mentioned, if aware of websockets (that's checked), pretend websocket server sending correct response. then, if not act correctly (e.g. form frames correctly), considered protocol violation. actually, can write websocket server incorrect, there not use in it.

and purpose prevent clients accidentally requesting websockets upgrade not expecting (say, adding corresponding headers manually , expecting smth else). sec-websocket-key , other related headers prohibited set using setrequestheader method in browsers.