Here we are verifying the response from the websocket server, we should expect only one protocol in the response.

The server will respond using the Sec-WebSocket-Protocol header to confirm which subprotocol will be used. This server will include this header only once in the response.

This is where I was confused by your reply to the earlier PR. We should ideally return to checking if the value equals "mqtt", not entirely sure if whitespace would be expected.

Header will be included only once, but it's valid to specify multiple subprotocols in it right?

e.g. if we want to specify two protocols, one option is to add that header multiple times

Sec-WebSocket-Protocol: mqtt
Sec-WebSocket-Protocol: chat

Or we can only include it once

Sec-WebSocket-Protocol: mqtt, chat

I think the quoted text is referring to later case.

The main point of the quote is:

The server will respond using the Sec-WebSocket-Protocol header to confirm which subprotocol will be used

i.e. the server must only respond with one chosen protocol, the first one from the list provided as header in the connection request

Okie! thanks for pointing out, the standards should be more explicit ig, causing confusion in interpretations haha. Anyways, i tested different clients:
paho ( python ) - doesn't verify the header at all!
mqttx - accepts only when it is "mqtt" as you mentioned.
mosquitto - can't connect over ws

So it would be fine if we just match "mqtt". 😄