ok little update. first problem is obviously the missing 8 byte of the handshake.

what happens is the following:

clients sends handshake

GET /socket.io/websocket HTTP/1.1
Upgrade: WebSocket
Connection: Upgrade
Host: websocket.local
Origin: http://websocket.local
Sec-WebSocket-Key1: '6F24 >168D1m/2T7b
Sec-WebSocket-Key2: 3 84w6 5 u{U45 7 17
Cookie: socketio=websocket

12345678

the server would forward the following:
GET /socket.io/websocket HTTP/1.0
Host: websocket.local
X-Real-IP: 127.0.0.1
X-Forwarded-For: 127.0.0.1
Connection: close
Upgrade: WebSocket
Origin: http://websocket.local
Sec-WebSocket-Key1: '6F24 >168D1m/2T7b
Sec-WebSocket-Key2: 3 84w6 5 u{U45 7 17
Cookie: socketio=websocket

note the missing websocket key3.

This is easily worked around(fixed) by adding

if (ngx_strcasestrn(h->key.data, "upgrade", 7 - 1) &&
ngx_strcasestrn(h->value.data, "websocket", 9 - 1)) {
r->headers_in.content_length_n = 8;
ngx_log_debug2(NGX_LOG_DEBUG_HTTP, r->connection->log, 0,
"Upgrade header found");
}

to ngx_http_request.c:ngx_http_process_request_headers
the next thing i don't get, node will response with a handshake:
HTTP/1.1 101 WebSocket Protocol Handshake
Upgrade: WebSocket
Connection: Upgrade
Sec-WebSocket-Origin: http://websocket.local
Sec-WebSocket-Location: ws://websocket.local/socket.io/websocket

n.E....Q.}../.(s.~m~16~m~5890598851256073..~m~16~m~~j~{"buffer":[]}.

nginx will return the following:
HTTP/1.1 101 WebSocket Protocol Handshake
Server: nginx/0.7.67
Date: Fri, 19 Nov 2010 13:41:48 GMT
Transfer-Encoding: chunked
Connection: keep-alive
Upgrade: WebSocket
Sec-WebSocket-Origin: http://websocket.local
Sec-WebSocket-Location: ws://websocket.local/socket.io/websocket

44
n.E....Q.}../.(s.~m~16~m~5890598851256073..~m~16~m~~j~{"buffer":[]}.

Question:
1. where do the 44 come in? how do they fit in?
2. can i store the state of the connection as being a websocket now. so that it doesn't rewrite the connection header?

Regards,
Reza