IIUC, it needs extensive code coverage and it's even difficult for library (the lws case).

Check out the "Secure Streams" of libwebsockets, it hides details of protocols specifics stuff (in the JSON policy) and easier to program network application (just deal with the abstracted states and payload in the callbacks).

https://libwebsockets.org/git/libwebsockets/tree/minimal-exa...

https://libwebsockets.org/git/libwebsockets/tree/lib/secure-...