SHA-1 (FIPS 180-4), used only to compute Sec-WebSocket-Accept. SHA-1 is not used for any security property here; RFC 6455 mandates it purely as a handshake checksum.
Sec-WebSocket-Accept