socket.io 400 bad request

Hi,

I’m using lounge behind a nginx reverse proxy and a varnish cache (not sure if it may cause the issue). I want use websocket and not the pulling method but it seems that there is an issue somewhere. In my browser log I got this:

400 GET https://webirc.mydomain.tld/socket.io/?EIO=3&transport=websocket&sid=-Snc_L_vXSjzNCZ8AAAA

and next, it’s fallback to the pulling method:

200 GET https://webirc.mydomain.tld/socket.io/?EIO=3&transport=polling&t=LrKfzG9&sid=-Snc_L_vXSjzNCZ8AAAA

When I try to connect directly on the 9000 port with ssh -L tunnel everything is working. My nginx config:

server {
	listen 8080;
	listen [::]:8080;

	server_name webirc.mydomin.tld;

	location / {
		proxy_pass http://127.0.0.1:9000/;
		proxy_http_version 1.1;
		proxy_set_header Connection "upgrade";
		proxy_set_header Upgrade $http_upgrade;
	#	proxy_set_header X-Forwarded-For $remote_addr;

		# by default nginx times out connections in one minute
		proxy_read_timeout 1d;
	}

	access_log /var/log/nginx/webirc_access.log;
	error_log /var/log/nginx/webirc_error.log;

}

server {
        listen 80;
        listen [::]:80;

        server_name webirc.mydomin.tld;

	return 301 https://$host$request_uri;

        access_log /var/log/nginx/webirc_access.log;
        error_log /var/log/nginx/webirc_error.log;
}

server {
	listen 443 ssl;
	listen [::]:443 ssl;

	server_name webirc.mydomin.tld;

	ssl on;
	ssl_certificate /etc/letsencrypt/live/webirc.mydomin.tld/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/webirc.mydomin.tld/privkey.pem;
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 10m;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4:!3DES:+HIGH:+MEDIUM;
	ssl_prefer_server_ciphers on;

	location / {
		proxy_pass http://127.0.0.1:81; # varnish is listening on the port
		proxy_set_header X-Real-IP  $remote_addr;
		#proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		proxy_set_header X-Forwarded-For $remote_addr;
		proxy_set_header X-Forwarded-Proto https;
		proxy_set_header X-Forwarded-Port 443;
		proxy_set_header Host $host;
	}

	access_log /var/log/nginx/webirc_access.log;
	error_log /var/log/nginx/webirc_error.log;
}

Nginx handle tls and redirect to varnish which is listening on port 81. Varnish redirect to nginx on port 8080 and finally nginx redirect to port 9000. This is a generic conf for all my webapp. I maybe can make a specific conf in varnish to directly redirect to node but this is not the point. This setup should works.

[xPaw]

I just tried visiting http://webirc.tld:8080/ which does have working websockets. This is either an issue with proxying via so many steps, or varnish is breaking it. Either way, this is not an issue with The Lounge, and we can not fix it.

As a side note, you should make all these ports (81, 8080, 9000) listen exclusively on 127.0.0.1 so they are not publicly accessible.

[loconox]

@bews I’m using nginx as TLS termination and it’s working well. In this case, you should configure your backend, node for instance, in clear http. For the record, I finally decided to remove varnish from my setup and put node directly after nginx as follow:

server {
        listen 80;
        listen [::]:80;

        server_name webirc.mydomain.tld;

	return 301 https://$host$request_uri;

        access_log /var/log/nginx/webirc_access.log;
        error_log /var/log/nginx/webirc_error.log;
}

server {
	listen 443 ssl;
	listen [::]:443 ssl;

	server_name webirc.mydomain.tld;

	ssl on;
	ssl_certificate /etc/letsencrypt/live/webirc.mydomain.tld/fullchain.pem;
	ssl_certificate_key /etc/letsencrypt/live/webirc.mydomain.tld/privkey.pem;
	ssl_dhparam /etc/cozy/dh.pem;
	ssl_session_cache shared:SSL:10m;
	ssl_session_timeout 10m;
	ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
	ssl_ciphers ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4:!3DES:+HIGH:+MEDIUM;
	ssl_prefer_server_ciphers on;

	location / {
		proxy_pass http://127.0.0.1:9000/;
		proxy_http_version 1.1;
		proxy_set_header Connection "upgrade";
		proxy_set_header Upgrade $http_upgrade;
		proxy_set_header X-Forwarded-For $remote_addr;

		# by default nginx times out connections in one minute
		proxy_read_timeout 1d;
	}

	access_log /var/log/nginx/webirc_access.log;
	error_log /var/log/nginx/webirc_error.log;
}

Not sure which was the issue, maybe linked with headers …