Nginx反向代理WebSocket响应403的解决办法

在Nginx反向代理一个带有WebSocket功能的Spring Web程序(源代码地址)时,发现访问WebSocket接口时总是出现403响应,Nginx的配置参考的是官方文档:

http {
    // ssl 相关配置 ...
    
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    server {
        listen 8020;
        location /ws {
            proxy_pass http://some-ip:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }
    }
}

唯一不同的是我们的Nginx配置了https。

于是打开Spring日志查看直接访问和通过Nginx访问的差别。

直接访问的日志:

DEBUG ... o.s.web.servlet.DispatcherServlet        : DispatcherServlet with name 'dispatcherServlet' processing GET request for [/ws/gs-guide-websocket/786/kz0qai5l/websocket]
DEBUG ... s.w.s.m.m.a.RequestMappingHandlerMapping : Looking up handler method for path /gs-guide-websocket/786/kz0qai5l/websocket
DEBUG ... s.w.s.m.m.a.RequestMappingHandlerMapping : Did not find handler method for [/gs-guide-websocket/786/kz0qai5l/websocket]
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : Matching patterns for request [/gs-guide-websocket/786/kz0qai5l/websocket] are [/gs-guide-websocket/**]
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : URI Template variables for request [/gs-guide-websocket/786/kz0qai5l/websocket] are {}
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : Mapping [/gs-guide-websocket/786/kz0qai5l/websocket] to HandlerExecutionChain with handler [org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler@307f6b8c] and 1 interceptor
DEBUG ... o.s.web.servlet.DispatcherServlet        : Last-Modified value for [/ws/gs-guide-websocket/786/kz0qai5l/websocket] is: -1
DEBUG ... o.s.web.cors.DefaultCorsProcessor        : Skip CORS processing: request is from same origin
DEBUG ... o.s.w.s.s.t.h.DefaultSockJsService       : Processing transport request: GET http://localhost:8080/ws/gs-guide-websocket/786/kz0qai5l/websocket
DEBUG ... o.s.web.servlet.DispatcherServlet        : Null ModelAndView returned to DispatcherServlet with name 'dispatcherServlet': assuming HandlerAdapter completed request handling
DEBUG ... o.s.web.servlet.DispatcherServlet        : Successfully completed request

通过Nginx访问的日志:

DEBUG ... o.s.web.servlet.DispatcherServlet        : DispatcherServlet with name 'dispatcherServlet' processing GET request for [/ws/gs-guide-websocket/297/jp1c3ab5/websocket]
DEBUG ... s.w.s.m.m.a.RequestMappingHandlerMapping : Looking up handler method for path /gs-guide-websocket/297/jp1c3ab5/websocket
DEBUG ... s.w.s.m.m.a.RequestMappingHandlerMapping : Did not find handler method for [/gs-guide-websocket/297/jp1c3ab5/websocket]
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : Matching patterns for request [/gs-guide-websocket/297/jp1c3ab5/websocket] are [/gs-guide-websocket/**]
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : URI Template variables for request [/gs-guide-websocket/297/jp1c3ab5/websocket] are {}
DEBUG ... o.s.w.s.s.s.WebSocketHandlerMapping      : Mapping [/gs-guide-websocket/297/jp1c3ab5/websocket] to HandlerExecutionChain with handler [org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler@307f6b8c] and 1 interceptor
DEBUG ... o.s.web.servlet.DispatcherServlet        : Last-Modified value for [/ws/gs-guide-websocket/297/jp1c3ab5/websocket] is: -1
DEBUG ... o.s.w.s.s.t.h.DefaultSockJsService       : Processing transport request: GET http://localhost:8080/ws/gs-guide-websocket/297/jp1c3ab5/websocket
DEBUG ... o.s.w.s.s.s.OriginHandshakeInterceptor   : Handshake request rejected, Origin header value https://some-host.com not allowed
DEBUG ... o.s.w.s.s.s.HandshakeInterceptorChain    : org.springframework.web.socket.server.support.OriginHandshakeInterceptor@25ce6ad4 returns false from beforeHandshake - precluding handshake
DEBUG ... o.s.web.servlet.DispatcherServlet        : Null ModelAndView returned to DispatcherServlet with name 'dispatcherServlet': assuming HandlerAdapter completed request handling
DEBUG ... o.s.web.servlet.DispatcherServlet        : Successfully completed request

注意到直接访问的日志里有这么一条:

DEBUG ... o.s.web.cors.DefaultCorsProcessor        : Skip CORS processing: request is from same origin

通过Nginx访问的日志里有这么一条:

DEBUG ... o.s.w.s.s.s.OriginHandshakeInterceptor   : Handshake request rejected, Origin header value https://some-host.com not allowed

然后Google查询相关解决办法,找到github上的这个issue,所以只需要修改Nginx的配置,添加proxy_set_header Origin "";就行了:

http {
    // ssl 相关配置 ...
    
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    server {
        listen 8020;
        location /ws {
            proxy_pass http://some-ip:8080;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_set_header Origin "";
        }
    }
}

本文参与腾讯云自媒体分享计划,欢迎正在阅读的你也加入,一起分享。

发表于

我来说两句

0 条评论
登录 后参与评论

相关文章

来自专栏码匠的流水账

使用openjdk9-alpine运行springboot2

本文主要研究怎么在docker的java9镜像上运行springboot2并精简jdk.

6421
来自专栏james大数据架构

常见的几种Flume日志收集场景实战

  这里主要介绍几种常见的日志的source来源,包括监控文件型,监控文件内容增量,TCP和HTTP。 Spool类型   用于监控指定目录内数据变更,若有新文...

3375
来自专栏Java呓语

# How to Install Jenkins on CentOS 7How to Install Jenkins on CentOS 7

Published on: Thu, May 19, 2016 at 4:54 am EST

1042
来自专栏Google Dart

AOP切面编程一 原

883
来自专栏全栈架构

Spring Boot 与 Kotlin 验证web表单信息

在做web开发的时候,我们需要验证表单,确认用户提交的信息是安全的,比如用户名不能超过多少位,密码不能少于多少位等等。

974
来自专栏北京马哥教育

性能测试与持续集成(JMeter+Jenkins)

目的 将性能测试与持续集成挂接起来 性能测试: JMeter 持续集成: Jenkins JMeter 下载JMeter,官网: http://jmeter.a...

4615
来自专栏开发与安全

About Cache Coherence, Atomic Operation, Memory Ordering, Memory Barrier, Volatile

写这篇文章的起因是看到何登成博士发的一个微博问题,如下: ? 自己想不太明白,顺下找了他以前分享的一些资料和其他人的博客阅读,在这里做个笔记,内容主要来自何博的...

2930
来自专栏一个会写诗的程序员的博客

Spring Boot 2.0 内嵌 Tomcat 定制 : WebServerFactoryCustomizer

Spring Boot 2.0 内嵌 Tomcat 定制 : WebServerFactoryCustomizer

2092
来自专栏web编程技术分享

用SpringBoot搭建简单电商项目 01

8468
来自专栏技术专栏

SpringBoot集成Thymeleaf的配置

4842

扫码关注云+社区

领取腾讯云代金券