The Last Spike Online / 16 July 2026
The multiplayer smoke test was green — until we tested it like a browser
The WebSocket smoke test was missing the production Origin header, so it exercised a connection under different conditions from the real browser client. The test had to move closer to actual production traffic.
Situation
A backend WebSocket endpoint may accept a simple client while a browser connection to the same endpoint fails because of origin policy. The first post-deploy smoke only checked whether a connection could be established. That was useful at the network level, but it did not prove that the real production integration worked.
Approach
I added the same production Origin to the smoke client that the browser sends. That put the server's origin validation, the reverse-proxy path and TLS under test together. The point was to stop the smoke test from bypassing exactly the security condition that the production client had to satisfy.
Outcome
The test became much more meaningful: a green result now proved more than an open port; it proved the relevant browser-style connection conditions as well. Future proxy or origin-configuration regressions would surface immediately after deployment.