nginx reverse proxy websockets

Question

nginx now supports proxying websockets, but I was unable to find any information on how to do this without having a separate location block that applies to URIs on which websockets are used.

I've seen some folks recommending some variations of this approach:

location / {
    proxy_http_version 1.1;

    proxy_set_header    Upgrade     $http_upgrade;
    proxy_set_header    Connection  "upgrade";

    proxy_pass  http://host:port;
}

Would that be the correct way to proxy standard HTTP as well as websockets?

I don't want the Upgrade header or Connection being set to upgrade unless that's what the browser sent, but these proxy_set_header lines are required for websockets to work.

Why doesn't nginx just forward the original Upgrade/Connection headers?

I've experimented with this and found that nginx does not proxy the Upgrade header and changes the Connection header to close from upgrade if running without the two proxy_set_header lines. With them, Connection is upgrade for non-websocket requests, which is also bad.

There seem to be a case mistprint in Nginx docs: Connection: "Upgrade" finally worked for me, instead. — Mimmo
– Mimmo, Commented Nov 29, 2022 at 15:23

Community · Accepted Answer · 2021-10-07 05:46:31Z

Why doesn't nginx just forward the original Upgrade/Connection headers?

From the official documentation: since the “Upgrade” is a hop-by-hop header, it is not passed from a client to proxied server

See RFC 2616.

I don't want the Upgrade header or Connection being set to "upgrade" unless that's what the browser sent,

There is also an example:

map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

server {
    ...

    location /chat/ {
        proxy_pass http://backend;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $connection_upgrade;
    }
}

Connection is 'upgrade' for non-websocket requests, which is also bad.

Do you actually know what the Connection header means? Just a quote from RFC: for each connection-token in this field, remove any header field(s) from the message with the same name as the connection-token.

How it can be bad?

justCurious · Accepted Answer · 2022-06-20 05:28:55Z

Solution: For k8s nginx ingress configuration, I've used:

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  namespace: prod-env
  name: core-backend
  labels:
    app: core-backend
  annotations:
    ingress.kubernetes.io/rewrite-target: /
    kubernetes.io/ingress.class: "nginx"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/server-snippets: |
      location / {
        proxy_set_header Upgrade $http_upgrade;
        proxy_http_version 1.1;
        proxy_set_header X-Forwarded-Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header Connection "upgrade";
        proxy_cache_bypass $http_upgrade;
        }

Collectives™ on Stack Overflow

nginx reverse proxy websockets

2 Answers 2

Comments

Comments

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Linked

Related