Java Community | Help. Code. Learn.•2mo ago

Deploying Spring Boot application with Stomp over WSS using nginx

Does anyone have experience with Secure Websockets (WSS) over Nginx? I currently have this nginx config file, but the websockets stopped working once I switched from unsecure http:// and ws:// to https:// and wss:// (the https:// traffic and the rest of the application works fine though, just the websocket connection fails to establish)

server {
    server_name 132.231.1.166;
    server_name sojourner-under-sabotage.se2.fim.uni-passau.de;

    location /websocket {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header HOST $host;
        proxy_set_header X_Forwarded_For $remote_addr;
        proxy_pass http://localhost:8080;
        proxy_redirect default;
        client_max_body_size 1000m;
    } 

    location / {
        proxy_pass http://127.0.0.1:8080/;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/sojourner-under-sabotage.se2.fim.uni-passau.de/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/sojourner-under-sabotage.se2.fim.uni-passau.de/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = sojourner-under-sabotage.se2.fim.uni-passau.de) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name 132.231.1.166;
    server_name sojourner-under-sabotage.se2.fim.uni-passau.de;
    return 404; # managed by Certbot


}

server {
    server_name 132.231.1.166;
    server_name sojourner-under-sabotage.se2.fim.uni-passau.de;

    location /websocket {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header HOST $host;
        proxy_set_header X_Forwarded_For $remote_addr;
        proxy_pass http://localhost:8080;
        proxy_redirect default;
        client_max_body_size 1000m;
    } 

    location / {
        proxy_pass http://127.0.0.1:8080/;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Server $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/sojourner-under-sabotage.se2.fim.uni-passau.de/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/sojourner-under-sabotage.se2.fim.uni-passau.de/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}

server {
    if ($host = sojourner-under-sabotage.se2.fim.uni-passau.de) {
        return 301 https://$host$request_uri;
    } # managed by Certbot


    listen 80;
    server_name 132.231.1.166;
    server_name sojourner-under-sabotage.se2.fim.uni-passau.de;
    return 404; # managed by Certbot


}

Do I need to change anything on the Java Spring side or the Tomcat setup?

32 Replies

JavaBot•2mo ago

⌛ This post has been reserved for your question.

Hey @<Tim>! Please use /close or the Close Post button above when your problem is solved. Please remember to follow the help guidelines. This post will be automatically marked as dormant after 300 minutes of inactivity.

TIP: Narrow down your issue to simple and precise questions to maximize the chance that others will reply in here.

dan1st•2mo ago

What exactly happens?

<Tim>OP•2mo ago

The websocket connection fails to connect

<Tim>OP•2mo ago

dan1st•2mo ago

Can you check the network tab?

<Tim>OP•2mo ago

it just shows the request headers afaik

dan1st•2mo ago

Can you show it? I'm interested in the actual websocket connection thing

<Tim>OP•2mo ago

dan1st•2mo ago

What's shown wrt response in the network tab? Does it show an error there?

<Tim>OP•2mo ago

the connection fails, so there's no response 🙈 If you want, you can try it out yourself, I just created a new test user: https://sojourner-under-sabotage.se2.fim.uni-passau.de/ borman360
2b022767

dan1st•2mo ago

yeah but normally there's an error thing in the request list I can see some 403s

dan1st•2mo ago

Is it these requests you are talking about?

<Tim>OP•2mo ago

no, in the network tab view I can't see any errors. But I can check in the server logs again maybe wait yes why does it show a 403 for you lol

dan1st•2mo ago

403 normally means forbidden idk

dan1st•2mo ago

and walking around works for me

dan1st•2mo ago

but I have no idea how to turn off the audio

<Tim>OP•2mo ago

yup, but you can't talk to the robot or do anything else, because that works only with the EventSystem in place click the mute icon at the browser tab xD I don't think there's another way yet, I should probably add that haha

dan1st•2mo ago

yeah that's what I did But for me, it's 403s meaning the server rejects it maybe the reverse proxy is configured to require some different authentication? Do the nginx logs tell you the same thing?

<Tim>OP•2mo ago

these are the nginx error logs, nothing to see really :(

<Tim>OP•2mo ago

(the only errors are from 2h ago) that's so weird. Maybe Spring Security has something to do with it

dan1st•2mo ago

Ar you getting the SSL errors whenever a WSS connection is created? actually doesn't look like it yeah, could be Spring Security

<Tim>OP•2mo ago

the catalina and tomcat logs don't show anything. In the access logs I can at least see your 403's though

<Tim>OP•2mo ago

oh no, Spring Security and Websockets/Stomp was already sketchy to setup in the first place 😭 Thanks for your help so far, I will look into it :)

dan1st•2mo ago

https://docs.spring.io/spring-security/reference/servlet/integrations/websocket.html

<Tim>OP•2mo ago

I will just leave my WebSocket and SpringSecurity Configs here, maybe someone sees something wrong with it 🙈 But I mean they worked fine for about a year now with ws://, just the ssl certificate making problems

WebSocketConfig.java

SecurityConfig.java

<Tim>OP•2mo ago

Ok so I now gave up and reverted all changes. The websocket doesn't even work with ws:// now though 😭 certbot did something weird with my poor websockets

dan1st•2mo ago

Maybe it only worked locally?

<Tim>OP•2mo ago

No, it worked in exactly this configuration for at least half a year without changes. I did multiple sessions of students playing the game in class last semester 🙈 very weird

dan1st•2mo ago

well I can't help you mean with "doesn't work" For diagnosing Spring related issues, you can configure logging differently

<Tim>OP•2mo ago

ok I fixed it xD I just allowed any origin and pushed it, good enough 😅 I mean you have to be logged in to send anything to the websocket anyways

registry.addEndpoint("/websocket").setAllowedOrigins("*").withSockJS();
registry.addEndpoint("/websocket").setAllowedOrigins("*");

registry.addEndpoint("/websocket").setAllowedOrigins("*").withSockJS();
registry.addEndpoint("/websocket").setAllowedOrigins("*");

Thanks for trying it out and finding out about the 403 @dan1st | Daniel !! 😊

JavaBot•2mo ago

If you are finished with your post, please close it. If you are not, please ignore this message. Note that you will not be able to send further messages here after this post have been closed but you will be able to create new posts.

JavaBot•2mo ago

Post Closed

This post has been closed by <@330307656105328640>.

Gaming

Programming

Deploying Spring Boot application with Stomp over WSS using nginx