See gorilla/websocket#589 for a complete description of the problem.

The summary is that compression middleware writes to hijacked connections on this line and the HTTP server panics as a result.

One fix for the issue is to detect hijack and avoid writing to the connection after hijack.

The larger problem is that the compression middleware should not do anything on a protocol upgrade request. The middleware assumes HTTP, but the connection will be used for a different protocol.

The middleware should call the handler directly when the connection upgrade token is present. Add the following to the beginning of the handler:

if httpguts.HeaderValuesContainsToken(r.Header["Connection"], "Upgrade") {
    h.ServeHTTP(w, r)
    return
}

If you don't want to add a dependency on httpguts, then do something like this:

var upgrade bool
for _, v := range strings.Split(r.Header.Get("Connection"), ",") {
    if strings.ToLower(strings.TrimSpace(v)) == "upgrade" {
        upgrade = true
        break
    }
}
if upgrade {
    h.ServeHTTP(w, r)
    return
}