const { statusCode, errorMessage } = extractErrorStatusAndMessage(err);
const headers = {
  'Connection': 'close',
  'Content-Type': 'text/plain',
  'Content-Length': 0,
  'X-Request-Id': request.id,
  'X-Error-Message': errorMessage   // NO CRLF sanitization
};
socket.end(
  `HTTP/1.1 ${statusCode} ${http.STATUS_CODES[statusCode]}\r
` +
  `${Object.keys(headers).map((key) => `${key}: ${headers[key]}`).join('\r
')}\r
\r
`
);

curl -i -X GET \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  http://TARGET:4000/api/v1/streaming/user

curl -i -X GET \
  -H "Upgrade: websocket" \
  -H "Connection: Upgrade" \
  -H "Sec-WebSocket-Version: 13" \
  -H "Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==" \
  -H "Authorization: Bearer test%0d%0aX-Injected: evil" \
  http://TARGET:4000/api/v1/streaming/user

const sanitizedMessage = String(errorMessage || '')
  .replace(/\r/g, '%0D')
  .replace(/\n/g, '%0A');
// OR use Node.js res.setHeader() API which prevents header injection