Proxy secure websocket to Play server through nginx

Question

I'm running a Play framework application, in which one piece of javascript needs to connect to a websocket on the server. The server is running an nginx proxy with SSL in front of the Play application, with the following settings:

proxy_buffering off;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header Host $host;
proxy_cache_path /var/lib/nginx/cache levels=1:2 keys_zone=one:10m max_size=500m;
proxy_cache_methods GET HEAD;
proxy_cache_key $host$uri$is_args$args;
proxy_cache_valid 200 10m;
proxy_http_version 1.1;

upstream backend {
    server 127.0.0.1:9001;
}

server {
    listen 443 ssl default_server;
    listen [::]:443 ssl default_server;
    ssl on;
    server_name www.studiecirkel.net;
    gzip off;

    ssl_certificate     /home/sfr/certs/ssl-bundle.crt;
    ssl_certificate_key /home/sfr/certs/server.key;
    ssl_session_timeout 5m;
    ssl_ciphers     EDH+CAMELLIA:EDH+aRSA:EECDH+aRSA+AESGCM:EECDH+aRSA+SHA384:EECDH+aRSA+SHA256:EECDH:+CAMELLIA256:+AES256:+CAMELLIA128:+AES128:+SSLv3:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!DSS:!RC4:!SEED:!ECDSA:CAMELLIA256-SHA:AES256-SHA:CAMELLIA128-SHA:AES128-SHA;
    ssl_prefer_server_ciphers on;

    location / {
        proxy_pass https://backend;
        auth_basic "Internt alpha-test";
        auth_basic_user_file /home/sfr/studiecirkel/.htpasswd;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        tcp_nodelay on;
    }
}

The javascript looks like the following:

var chatSocket = new WS("@routes.HomeController.connectChat().webSocketURL(request)");

And the connectChat method looks like this:

public LegacyWebSocket<JsonNode> connectChat() {
        return new LegacyWebSocket<JsonNode>() {
            public void onReady(WebSocket.In<JsonNode> in, WebSocket.Out<JsonNode> out){
                // Some internal code here
            }
        };
    }

This worked fine when everything was on localhost, but now that the server is in the cloud, I get the following error in Chromium:

WebSocket connection to 'wss://backend/messages/socket/' failed: Error in connection establishment: net::ERR_NAME_NOT_RESOLVED

I have also tried switching the proxy_pass directive address from backend to 127.0.0.1:9001 and then I get ERR_CONNECTION_REFUSED instead.

If I try to use "proxy_pass http://backend" and switch to non-SSL behind the proxy, the browser says the websocket connection is not secure and won't connect.

What could be wrong here? Do websockets have to be able to connect directly to the proxied URL? Do SSL-enabled websockets not work this way?

Sangram Jadhav Sangram Jadhav · Accepted Answer · 2016-10-12T09:06:38

The problem is with this code

var chatSocket = new WS("@routes.HomeController.connectChat().webSocketURL(request)")

It is resolved at Server and therefore ERR_NAME_NOT_RESOLVED error is appeared. This is DNS error when client failed to resolve host which is backend in your case and browser is unable to resolve it.

Try to replace this with below code and see if it works

var chatSocket = new WS("messages/socket/");

Update. Seems like above code is not sufficient. Below is a way to get host from document object

var webSocketURL = 'wss://' + window.location.host + '/messages/socket/';
var chatSocket = new (webSocketURL);

Proxy secure websocket to Play server through nginx

1 Answers