Field note
ChatGPT WebSocket Errors: What IT Should Check
ChatGPT can load its page over ordinary HTTPS and still fail to answer because the streaming connection behind it is blocked, rewritten or dropped by the office network.
ChatGPT can load its page over ordinary HTTPS and still fail to answer because the streaming connection behind it is blocked, rewritten or dropped by the office network.
The symptoms
The pattern is distinctive once you know it. The login works and the chat history appears. A prompt sends, the cursor spins, and then either nothing arrives, a "network error" banner appears, or the answer starts and stops part way through. Long answers fail more often than short ones. The same account works on a phone hotspot, at home or on a personal laptop, and fails on office Wi-Fi, the VPN or a managed device.
If you see that split between networks, stop blaming the user's browser and treat it as a network path problem.
Likely causes, most common first
- TLS inspection on the firewall or proxy. Many UK small-business firewalls decrypt HTTPS to scan it. A WebSocket starts as an HTTPS request that asks to upgrade to a persistent connection. Some inspection engines cannot follow the upgrade and quietly drop or reset it.
- A proxy that does not pass the upgrade through. Older explicit proxies and some web-filter agents handle normal page requests but not the
Upgrade: websockethandshake, so the page loads and the stream never starts. - Idle or connection timeouts. Firewalls, load balancers and VPN concentrators often close connections that look idle or run longer than a fixed limit. A long answer streams for minutes on one connection, which is exactly what those timers kill.
- Partial domain allow-lists. IT allowed
chatgpt.combut not the related content and asset domains the app also uses. The shell loads; parts of the app fail. - Browser extensions and endpoint agents. Ad blockers, privacy extensions and some endpoint security agents interfere with streaming responses on the client side.
- An OpenAI incident. Less common than people assume, but it happens. Check before you change anything.
Step-by-step fix
- Confirm the network split. Ask the user to reproduce on a phone hotspot with the same account and the same browser. If it works there, the office path is the problem.
- Rule out the client. On the office network, try a private window with extensions disabled and a second browser. If both fail, move on.
- Look at the handshake. In the browser developer tools, open the Network tab, filter by WS, and send a prompt. A healthy WebSocket shows a
101 Switching Protocolsresponse and then stays open. A blocked one shows a failed request, a403or502, or a connection that opens and closes within a second or two. - Pull the firewall or proxy log for that minute. Search for the user's IP and the OpenAI domains. A TLS inspection error, a reset or a category block will usually be visible.
- Make one narrow change. Exclude the OpenAI application domains from TLS inspection, or add a WebSocket pass-through rule for them, whichever the vendor supports. Use the domain list from OpenAI's own network recommendations article in the ChatGPT help centre rather than guessing; the list is maintained by OpenAI and changes.
- Check timeouts. If long answers still cut off, raise the idle timeout for those destinations or exempt them from the connection-duration limit.
- Retest with the same prompt, then a deliberately long one. Record the change, the reason and the rollback in the change log.
Do not solve this by switching the whole firewall to "no inspection" or by giving the user a personal account outside the workspace. Both remove a control to fix a symptom.
What IT should check on managed estates
If devices are managed with Intune and protected with Defender, check the web content filtering policy as well as the perimeter firewall. Defender for Endpoint can block a category or an indicator and the user sees the same stalled chat. Our note on Defender for Business web content filtering explains where those blocks show up.
On VPNs, check whether ChatGPT traffic goes through the tunnel or splits out locally. A split tunnel that sends the page one way and the WebSocket another is a common source of "works sometimes" reports.
Keep the exemption narrow. Exclude only the OpenAI domains from inspection, apply the rule to the ChatGPT Business or Enterprise workspace users, and review it when the domain list changes. If the business has never written down which AI tools are allowed and on which accounts, the AI governance review covers that before it becomes a helpdesk pattern.
When to escalate to OpenAI
Escalate when the WebSocket handshake succeeds, the firewall logs are clean, the hotspot test also fails, or the OpenAI status page shows a live incident. Give support the workspace name, the time in UTC, the browser and version, and a HAR file with the failing request. Remove cookies and tokens from the HAR before sending it. Workspace owners on Business and Enterprise plans get a support route through the admin console; personal-plan users do not, which is another reason company use belongs on the company plan.
If the problem is only on your network and OpenAI can see nothing wrong, the answer is in your proxy, firewall or endpoint logs, and the steps above will find it.