WebSocket support across the major CDNs — limits, timeouts, WAF behavior, and the alternatives when your edge won't hold a connection open.
Winner depends on your workload.
Winner depends on: whether you need a transparent proxy for your own socket servers (Cloudflare, CloudFront, Fastly passthrough — and now Azure Front Door, with hard limits), or a managed fan-out layer that holds millions of connections for you (Fastly Fanout, pub/sub services) — and how your WAF is supposed to behave after the upgrade handshake.
The awkward guest at the cache party
A CDN is built around short, cacheable request-response pairs; a WebSocket is a connection that upgrades once and then stays open for hours, carrying frames no cache can help with. Supporting it at the edge is therefore a proxying promise, not a caching one — and the fine print (idle timeouts, connection ceilings, what the WAF inspects) matters more than the headline "supported."
| Provider | WebSocket support | The fine print |
|---|---|---|
| Cloudflare | Supported on all plans, on by default | Proxied transparently; Workers can also terminate sockets, and Durable Objects hold state |
| Amazon CloudFront | Supported since 2018, no configuration needed | Upgrade handled automatically when the viewer requests it; origin timeouts still apply |
| Azure Front Door | Now GA (May 2026) on Standard and Premium | Connections capped at 4 hours, 5-minute idle timeout, 3,000 concurrent connections per profile; WAF inspects only the establishment phase; caching must be off on socket routes; no SSE |
| Fastly | Passthrough supported; Fanout offered as a managed real-time layer | Fanout terminates long-lived connections at the edge and lets your origin stay stateless |
| Akamai | Supported on appropriate delivery configurations | Set in the property; confirm product coverage with your account team |
| Bunny.net / Gcore / CDN77 | Proxying available on current platforms | Verify idle-timeout defaults per provider before relying on long sessions |
Azure Front Door: finally, with a leash
The biggest recent change in this matrix is AFD's WebSocket support reaching general availability in May 2026 — for years the standing answer was "use Application Gateway instead." The GA feature works without configuration, but its documented limits deserve respect in any design review: a socket lives at most four hours before the platform may recycle it, five idle minutes closes it, and a Front Door profile holds 3,000 concurrent global connections — a ceiling a modestly popular chat app can hit before lunch. Microsoft's guidance to build reconnect logic is not boilerplate; with these numbers it is architecture. Note also the security shape shared by most edges: the WAF inspects the HTTP upgrade, and once the tunnel is established, frames flow uninspected.
Transparent proxy versus managed fan-out
Cloudflare and CloudFront represent the transparent school: the edge passes the upgrade through and your origin owns every connection — simple, but your fleet must hold one file descriptor per user, forever. Fastly's Fanout represents the other school: the edge holds the long-lived connections and your origin publishes messages to channels, staying stateless between events. For broadcast-shaped traffic — scores, tickers, auction updates — fan-out is dramatically cheaper to operate than a socket farm; for genuinely bidirectional per-user sessions, a transparent proxy in front of your own servers remains the honest fit. Cloudflare's Durable Objects offer a third way, giving each room or document a single stateful coordinator at the edge — the platform seam we compared in Fastly Compute vs Cloudflare Workers.
Design notes that survive vendor choice
Whatever the edge, three rules hold. Disable caching on socket paths — AFD documents outright that a cached route swallows the Upgrade header and the handshake fails, and equivalents bite elsewhere. Treat idle timeouts as protocol: heartbeat pings under the smallest timeout in the chain (edge, LB, origin) or watch sessions die silently. And reconnect with jitter — a deploy that drops 100,000 sockets simultaneously becomes a self-inflicted thundering herd, the same failure geometry we traced in multi-CDN failover lessons. If your real requirement is server-to-client push only, weigh SSE or long-polling first — noting AFD explicitly does not support SSE. Facts verified against provider documentation, July 2026.
Designing real-time delivery and unsure whether to proxy, fan out, or rebuild? The assessment maps the options onto your session shapes.