diff --git a/lib/secure-streams/README.md b/lib/secure-streams/README.md
index 6098008e1..730d6f8f4 100644
--- a/lib/secure-streams/README.md
+++ b/lib/secure-streams/README.md
@@ -13,6 +13,17 @@ creation, but able to be updated from a remote copy.
 
 ![overview](../doc-assets/ss-explain.png)
 
+## Convention for rx and tx callback return
+
+Function|Return|Meaning
+---|---|---
+tx|0|Send the amount of `buf` stored in `*len`
+tx|>0|Do not send anything
+tx|<0|Finished with stream
+rx|>=0|accepted
+rx|<0|Finished with stream
+
+
 # JSON Policy Database
 
 Example JSON policy... formatting is shown for clarity but whitespace can be
diff --git a/lib/secure-streams/protocols/ss-h1.c b/lib/secure-streams/protocols/ss-h1.c
index 2daf8747f..4376f41c1 100644
--- a/lib/secure-streams/protocols/ss-h1.c
+++ b/lib/secure-streams/protocols/ss-h1.c
@@ -162,7 +162,7 @@ secstream_h1(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
 	uint8_t buf[LWS_PRE + 1520], *p = &buf[LWS_PRE],
 		*end = &buf[sizeof(buf) - 1];
-	int f = 0, m, status;
+	int f = 0, m, status, txr;
 	size_t buflen;
 
 	switch (reason) {
@@ -410,7 +410,8 @@ malformed:
 	//	lwsl_notice("%s: HTTP_READ: client side sent len %d fl 0x%x\n",
 	//		    __func__, (int)len, (int)f);
 
-		h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, f);
+		if (h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, f) < 0)
+			return -1;
 
 		return 0; /* don't passthru */
 
@@ -467,7 +468,12 @@ malformed:
 
 #endif
 
-		if (h->info.tx(ss_to_userobj(h),  h->txord++, p, &buflen, &f)) {
+		txr = h->info.tx(ss_to_userobj(h),  h->txord++, p, &buflen, &f);
+		if (txr < 0) {
+			lwsl_debug("%s: tx handler asked to close\n", __func__);
+			return -1;
+		}
+		if (txr > 0) {
 			/* don't want to send anything */
 			lwsl_debug("%s: dont want to write\n", __func__);
 			return 0;
diff --git a/lib/secure-streams/protocols/ss-mqtt.c b/lib/secure-streams/protocols/ss-mqtt.c
index 99a36b615..1c6d506be 100644
--- a/lib/secure-streams/protocols/ss-mqtt.c
+++ b/lib/secure-streams/protocols/ss-mqtt.c
@@ -31,8 +31,8 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
 	lws_mqtt_publish_param_t mqpp, *pmqpp;
 	uint8_t buf[LWS_PRE + 1400];
+	int f = 0, txr;
 	size_t buflen;
-	int f = 0;
 
 	switch (reason) {
 
@@ -93,8 +93,9 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 		h->subseq = 1;
 
-		h->info.rx(ss_to_userobj(h), (const uint8_t *)pmqpp->payload,
-			   len, f);
+		if (h->info.rx(ss_to_userobj(h), (const uint8_t *)pmqpp->payload,
+			   len, f) < 0)
+			return -1;
 
 		return 0; /* don't passthru */
 
@@ -143,8 +144,13 @@ secstream_mqtt(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 
 		buflen = sizeof(buf) - LWS_PRE;
-		if (h->info.tx(ss_to_userobj(h),  h->txord++, buf + LWS_PRE,
-				&buflen, &f))
+		txr = h->info.tx(ss_to_userobj(h),  h->txord++, buf + LWS_PRE,
+				 &buflen, &f);
+		if (txr < 0) {
+			lwsl_debug("%s: tx handler asked to close\n", __func__);
+			return -1;
+		}
+		if (txr > 0)
 			/* don't want to send anything */
 			return 0;
 
diff --git a/lib/secure-streams/protocols/ss-raw.c b/lib/secure-streams/protocols/ss-raw.c
index 05dc8248e..bad9c2575 100644
--- a/lib/secure-streams/protocols/ss-raw.c
+++ b/lib/secure-streams/protocols/ss-raw.c
@@ -33,7 +33,7 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
 	uint8_t buf[LWS_PRE + 1520], *p = &buf[LWS_PRE],
 		*end = &buf[sizeof(buf) - 1];
-	int f = 0;
+	int f = 0, txr;
 	size_t buflen;
 
 	switch (reason) {
@@ -78,7 +78,8 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		if (!h)
 			return 0;
 
-		h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, 0);
+		if (h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, 0) < 0)
+			return -1;
 
 		return 0; /* don't passthru */
 
@@ -88,7 +89,12 @@ secstream_raw(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 			return 0;
 
 		buflen = lws_ptr_diff(end, p);
-		if (h->info.tx(ss_to_userobj(h),  h->txord++, p, &buflen, &f)) {
+		txr = h->info.tx(ss_to_userobj(h),  h->txord++, p, &buflen, &f);
+		if (txr < 0) {
+			lwsl_debug("%s: tx handler asked to close\n", __func__);
+			return -1;
+		}
+		if (txr > 0) {
 			/* don't want to send anything */
 			lwsl_debug("%s: dont want to write\n", __func__);
 			return 0;
diff --git a/lib/secure-streams/protocols/ss-ws.c b/lib/secure-streams/protocols/ss-ws.c
index 91d36a580..086975cbd 100644
--- a/lib/secure-streams/protocols/ss-ws.c
+++ b/lib/secure-streams/protocols/ss-ws.c
@@ -30,8 +30,8 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 {
 	lws_ss_handle_t *h = (lws_ss_handle_t *)lws_get_opaque_user_data(wsi);
 	uint8_t buf[LWS_PRE + 1400];
+	int f = 0, f1, txr;
 	size_t buflen;
-	int f = 0, f1;
 
 	switch (reason) {
 
@@ -83,7 +83,8 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 
 		h->subseq = 1;
 
-		h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, f);
+		if (h->info.rx(ss_to_userobj(h), (const uint8_t *)in, len, f) < 0)
+			return -1;
 
 		return 0; /* don't passthru */
 
@@ -98,8 +99,13 @@ secstream_ws(struct lws *wsi, enum lws_callback_reasons reason, void *user,
 		}
 
 		buflen = sizeof(buf) - LWS_PRE;
-		if (h->info.tx(ss_to_userobj(h),  h->txord++, buf + LWS_PRE,
-				&buflen, &f))
+		txr = h->info.tx(ss_to_userobj(h),  h->txord++, buf + LWS_PRE,
+				&buflen, &f);
+		if (txr < 0) {
+			lwsl_debug("%s: tx handler asked to close\n", __func__);
+			return -1;
+		}
+		if (txr > 0)
 			/* don't want to send anything */
 			return 0;