diff --git a/lib/net_ws.c b/lib/net_ws.c
index bb5d87c4f3..84dd02f8a7 100644
--- a/lib/net_ws.c
+++ b/lib/net_ws.c
@@ -173,6 +173,13 @@ static ssize_t read_ws_payloadlen_short(struct mosquitto *mosq)
 	}
 
 	mosq->wsd.mask = (hbuf & 0x80) >> 7;
+	if(mosq->wsd.mask == 0){
+		/* RFC 6455 5.1: a server MUST close the connection on receipt of a frame
+		 * that is not masked. */
+		mosq->wsd.disconnect_reason = 0xEA;
+		errno = EPROTO;
+		return -1;
+	}
 	plen = hbuf & 0x7F;
 
 	if(plen == 126){
diff --git a/src/session_expiry.c b/src/session_expiry.c
index 095930dcfe..a84ea10937 100644
--- a/src/session_expiry.c
+++ b/src/session_expiry.c
@@ -198,7 +198,8 @@ void session_expiry__check(void)
 	last_check = db.now_real_s;
 
 	DL_FOREACH_SAFE(expiry_list, item, tmp){
-		if(item->context->session_expiry_time < db.now_real_s){
+		if(item->context->session_expiry_time < db.now_real_s
+				&& item->context->bridge == NULL){   /* Outgoing bridge connections never expire */
 
 			context = item->context;
 			session_expiry__remove(context);