From 74decb21c2f61548d159459d79d85db985c9d7b8 Mon Sep 17 00:00:00 2001
From: Lukasz Raczylo <lukasz@raczylo.com>
Date: Mon, 28 Sep 2026 17:28:01 +0100
Subject: [PATCH] docs: note where streamingRefresh sends the WebSocket cookie

On a WebSocket upgrade, the refreshed session cookie arrives on the 101
response. Traefik keeps middleware headers on that response, and RFC 6455
section 4.1 has clients store cookies from it.

Claude-Session: https://claude.ai/code/session_01G1d1n1BrHHHw8dBUkbiBPC
---
 README.md | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/README.md b/README.md
index 485a720..44dc271 100644
--- a/README.md
+++ b/README.md
@@ -322,7 +322,8 @@ WebSocket upgrade. The middleware handles this automatically:
   for streaming until the session cookie expires. Set `streamingRefresh: true`
   to refresh an expired token on the request. If the IdP rejects the refresh
   (`invalid_grant`), the request gets `401`. If the IdP cannot be reached,
-  the request is forwarded as before.
+  the request is forwarded as before. On a WebSocket upgrade, the refreshed
+  session cookie arrives on the `101 Switching Protocols` response.
 
 No configuration needed — this is implicit behavior.