Azure WebSockets + NodeBB + Node.js Proxy

Question

I have 2 webapps running on Azure (linux servers).

One webapp is running NodeBB (v1.12.1) - https://my-forum.azurewebsites.net

This app should not be accessed directly, instead, it is proxied into the second web app running on Azure.

The NodeBB config is set up so that the 'url' is 'https://my-website.azurewebsites.net/forums/'

I have added URLs in the socket.io:origins nconf to be able to make WebSocket requests from other URLs. The values look like this: http://my-website.azurewebsites.net:* https://my-website.azurewebsites.net:* https://my-forum.azurewebsites.net:* https://localhost:*

The main website (https://my-website.azurewebsites.net) is a Node.js & Express app with some frontend routes, api routes and uses the http-proxy-middleware module to proxy requests to the forum. The setup and configuration of that looks like this:

...

const proxy = require('http-proxy-middleware');
const forumProxy = proxy({
    target: process.env.FORUM_URL,
    changeOrigin: true,
    ws: true,
    secure: true,
    xfwd: true,
    logLevel: 'debug'
});
app.use('/forums', forumProxy);

const mainserver = http.createServer(app);
... other config
mainserver.on('upgrade', forumProxy.upgrade);

When I run the main website locally (https://localhost:3000) and Proxy the NodeBB forum, I can see that WebSockets are established correctly and messages are exchanged between the local version of the website and the Azure hosted NodeBB forum.

However, when the website is on Azure it Proxy's the URLs and the site perfectly fine but the WebSocket connection does not work. A '2probe' message is sent by the main website but a connection is never established and messages are not exchanged.

Accessing the forum URL directly works as expected, including WebSocket messages being exchanged.

Both the main website and forum have a web.config which contains:

<system.webServer>
    <webSocket enabled="false"/>
</system.webServer>

Both apps also have the --web-sockets-enabled=true value set on the server (which was set via PowerShell).

As I understand it, this makes WebSocket enabled on the server and the value in the web.config of 'false' is to turn off iis WebSockets and let Node.js handle it.

There seems to be a problem with 2 Azure servers talking to each other via WebSockets. Local to Azure works fine.

Why is it that 'https://my-website.azurewebsites.net' cannot establish a WebSocket to 'https://my-forum.azurewebsites.net'? but Local to Azure can?

AjayKumar-MSFT AjayKumar-MSFT · Accepted Answer · 2019-06-26T19:08:44

Azure WebApps run in a secure environment called sandbox. The only way an application can be accessed via the internet is through the already-exposed HTTP (80) and HTTPS (443) TCP ports; applications may not listen on other ports for packets arriving from the internet. However, applications may create a socket which can listen for connections from within the sandbox. For example, two processes within the same app may communicate with one another via TCP sockets; connection attempts incoming from outside the sandbox, albeit they be on the same machine, will fail.

Connection attempts to local addresses (e.g. localhost, 127.0.0.1) and the machine's own IP will fail, except if another process in the same sandbox has created a listening socket on the destination port.

Azure WebSockets + NodeBB + Node.js Proxy

2 Answers