[GH-ISSUE #723] Websocket configuration

kerem commented

2026-02-26 06:33:39 +03:00

Owner

Originally created by @Wadera on GitHub (Nov 16, 2020).
Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/723

What is troubling you?
I'm struggled to configure websocket nginx on my NPM:
https://extiverse.com/extension/kyrne/websocket

That's my current config:

Full Custom Nginx Configuration:

proxy_hide_header Upgrade;
proxy_hide_header X-Powered-By;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cache-Control "no-transform" always;
add_header Referrer-Policy no-referrer always;
add_header X-Robots-Tag none;

location @ws {
proxy_pass http://$server:1234;
proxy_set_header Host $http_host;
proxy_read_timeout     60;
proxy_connect_timeout  60;
proxy_redirect         off;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}

Where 1324 is the port of my websocket application.

Unfortunately - I can't establish connection. From browser console:

Pusher :  : ["Connecting",{"transport":"ws","url":"wss://dev.mywebsite.com:443/app/(...)?protocol=7&client=js&version=5.1.1&flash=false"}]

WebSocket connection to 'wss://dev.mywebsite.com/app/(...)?protocol=7&client=js&version=5.1.1&flash=false' failed: Error during WebSocket handshake: Unexpected response code: 404

I can connect into it without proxy like:
wss://dev.mywebsite.com:1234

What I'm doing wrong?

Originally created by @Wadera on GitHub (Nov 16, 2020). Original GitHub issue: https://github.com/NginxProxyManager/nginx-proxy-manager/issues/723 **What is troubling you?** I'm struggled to configure websocket nginx on my NPM: https://extiverse.com/extension/kyrne/websocket That's my current config: ![image](https://user-images.githubusercontent.com/407236/99294732-5e4a2b80-283c-11eb-8a91-61148eca0990.png) ![image](https://user-images.githubusercontent.com/407236/99294840-85a0f880-283c-11eb-8608-06479de924b5.png) ![image](https://user-images.githubusercontent.com/407236/99294902-9baeb900-283c-11eb-9d8c-56292e7fec92.png) Full **Custom Nginx Configuration**: ``` proxy_hide_header Upgrade; proxy_hide_header X-Powered-By; add_header Content-Security-Policy "upgrade-insecure-requests"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Cache-Control "no-transform" always; add_header Referrer-Policy no-referrer always; add_header X-Robots-Tag none; location @ws { proxy_pass http://$server:1234; proxy_set_header Host $http_host; proxy_read_timeout 60; proxy_connect_timeout 60; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } ``` Where `1324` is the port of my websocket application. Unfortunately - I can't establish connection. From browser console: ``` Pusher : : ["Connecting",{"transport":"ws","url":"wss://dev.mywebsite.com:443/app/(...)?protocol=7&client=js&version=5.1.1&flash=false"}] WebSocket connection to 'wss://dev.mywebsite.com/app/(...)?protocol=7&client=js&version=5.1.1&flash=false' failed: Error during WebSocket handshake: Unexpected response code: 404 ``` I can connect into it without proxy like: `wss://dev.mywebsite.com:1234` What I'm doing wrong?

kerem

2026-02-26 06:33:39 +03:00

closed this issue
added the
product-support
label

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@Wadera commented on GitHub (Nov 16, 2020):

from tcpdump

# tcpdump -i eth0 -s 1500 port 1234
tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes
18:55:31.846571 IP 192.168.1.123.45418 > n1.myhost.com: Flags [F.], seq 1197724386, ack 300370388, win 502, options [nop,nop,TS val 2803418848 ecr 1737801091], length 0
18:55:31.846741 IP n1.myhost.com > 192.168.1.123.45418: Flags [F.], seq 1, ack 1, win 506, options [nop,nop,TS val 1737831097 ecr 2803418848], length 0
18:55:31.846868 IP 192.168.1.123.45418 > n1.myhost.com: Flags [.], ack 2, win 502, options [nop,nop,TS val 2803418848 ecr 1737831097], length 0
18:56:01.873028 IP 192.168.1.123.45710 > n1.myhost.com: Flags [S], seq 3933311257, win 64240, options [mss 1460,sackOK,TS val 2803448874 ecr 0,nop,wscale 7], length 0
18:56:01.873050 IP n1.myhost.com > 192.168.1.123.45710: Flags [S.], seq 3088915225, ack 3933311258, win 65160, options [mss 1460,sackOK,TS val 1737861123 ecr 2803448874,nop,wscale 7], length 0
18:56:01.873144 IP 192.168.1.123.45710 > n1.myhost.com: Flags [.], ack 1, win 502, options [nop,nop,TS val 2803448874 ecr 1737861123], length 0
18:56:01.873175 IP 192.168.1.123.45710 > n1.myhost.com: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 2803448874 ecr 1737861123], length 517
18:56:01.873180 IP n1.myhost.com > 192.168.1.123.45710: Flags [.], ack 518, win 506, options [nop,nop,TS val 1737861123 ecr 2803448874], length 0
18:56:31.884789 IP 192.168.1.123.45710 > n1.myhost.com: Flags [F.], seq 518, ack 1, win 502, options [nop,nop,TS val 2803478886 ecr 1737861123], length 0
18:56:31.884914 IP n1.myhost.com > 192.168.1.123.45710: Flags [F.], seq 1, ack 519, win 506, options [nop,nop,TS val 1737891135 ecr 2803478886], length 0
18:56:31.885071 IP 192.168.1.123.45710 > n1.myhost.com: Flags [.], ack 2, win 502, options [nop,nop,TS val 2803478886 ecr 1737891135], length 0

where 192.168.1.123 is my docker host (NMP) IP.

@Wadera commented on GitHub (Nov 16, 2020): from tcpdump ``` # tcpdump -i eth0 -s 1500 port 1234 tcpdump: verbose output suppressed, use -v or -vv for full protocol decode listening on eth0, link-type EN10MB (Ethernet), capture size 1500 bytes 18:55:31.846571 IP 192.168.1.123.45418 > n1.myhost.com: Flags [F.], seq 1197724386, ack 300370388, win 502, options [nop,nop,TS val 2803418848 ecr 1737801091], length 0 18:55:31.846741 IP n1.myhost.com > 192.168.1.123.45418: Flags [F.], seq 1, ack 1, win 506, options [nop,nop,TS val 1737831097 ecr 2803418848], length 0 18:55:31.846868 IP 192.168.1.123.45418 > n1.myhost.com: Flags [.], ack 2, win 502, options [nop,nop,TS val 2803418848 ecr 1737831097], length 0 18:56:01.873028 IP 192.168.1.123.45710 > n1.myhost.com: Flags [S], seq 3933311257, win 64240, options [mss 1460,sackOK,TS val 2803448874 ecr 0,nop,wscale 7], length 0 18:56:01.873050 IP n1.myhost.com > 192.168.1.123.45710: Flags [S.], seq 3088915225, ack 3933311258, win 65160, options [mss 1460,sackOK,TS val 1737861123 ecr 2803448874,nop,wscale 7], length 0 18:56:01.873144 IP 192.168.1.123.45710 > n1.myhost.com: Flags [.], ack 1, win 502, options [nop,nop,TS val 2803448874 ecr 1737861123], length 0 18:56:01.873175 IP 192.168.1.123.45710 > n1.myhost.com: Flags [P.], seq 1:518, ack 1, win 502, options [nop,nop,TS val 2803448874 ecr 1737861123], length 517 18:56:01.873180 IP n1.myhost.com > 192.168.1.123.45710: Flags [.], ack 518, win 506, options [nop,nop,TS val 1737861123 ecr 2803448874], length 0 18:56:31.884789 IP 192.168.1.123.45710 > n1.myhost.com: Flags [F.], seq 518, ack 1, win 502, options [nop,nop,TS val 2803478886 ecr 1737861123], length 0 18:56:31.884914 IP n1.myhost.com > 192.168.1.123.45710: Flags [F.], seq 1, ack 519, win 506, options [nop,nop,TS val 1737891135 ecr 2803478886], length 0 18:56:31.885071 IP 192.168.1.123.45710 > n1.myhost.com: Flags [.], ack 2, win 502, options [nop,nop,TS val 2803478886 ecr 1737891135], length 0 ``` where `192.168.1.123` is my docker host (NMP) IP.

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@Wadera commented on GitHub (Nov 23, 2020):

Anyone?
Boss: @jc21 - any advise? :)

@Wadera commented on GitHub (Nov 23, 2020): Anyone? Boss: @jc21 - any advise? :)

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@jc21 commented on GitHub (Nov 23, 2020):

This seems like a complicated configuration. You're essentially wanting your proxy host to route between 2 different ports, one for general http and the other for a websocket server.

The first thing I can see is that you have defined a named nginx location @ws but you're not using it anywhere in any requests. You probably need something like

location /app {
    try_files $uri @ws;
}

and what I can see is a request to wss://dev.mywebsite.com/app/(...)? but without knowing what's missing in those 3 dots it might be hard to define the location properly.

@jc21 commented on GitHub (Nov 23, 2020): This seems like a complicated configuration. You're essentially wanting your proxy host to route between 2 different ports, one for general http and the other for a websocket server. The first thing I can see is that you have defined a named nginx location `@ws` but you're not using it anywhere in any requests. You probably need something like ``` location /app { try_files $uri @ws; } ``` and what I can see is a request to `wss://dev.mywebsite.com/app/(...)?` but without knowing what's missing in those 3 dots it might be hard to define the location properly.

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@jc21 commented on GitHub (Nov 23, 2020):

Also, why hide proxy headers? Especially the Upgrade one which is required for websocket support.

@jc21 commented on GitHub (Nov 23, 2020): Also, why hide proxy headers? Especially the Upgrade one which is required for websocket support.

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@Wadera commented on GitHub (Dec 3, 2020):

Thank you very much for support!

It's working with setup like that:

#proxy_hide_header Upgrade;
proxy_hide_header X-Powered-By;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cache-Control "no-transform" always;
add_header Referrer-Policy no-referrer always;
add_header X-Robots-Tag none;

location /app {
    try_files $uri @ws;
}

location @ws {
proxy_pass http://$server:1234;
proxy_set_header Host $http_host;
proxy_read_timeout     60;
proxy_connect_timeout  60;
proxy_redirect         off;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}

@Wadera commented on GitHub (Dec 3, 2020): Thank you very much for support! It's working with setup like that: ``` #proxy_hide_header Upgrade; proxy_hide_header X-Powered-By; add_header Content-Security-Policy "upgrade-insecure-requests"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Cache-Control "no-transform" always; add_header Referrer-Policy no-referrer always; add_header X-Robots-Tag none; location /app { try_files $uri @ws; } location @ws { proxy_pass http://$server:1234; proxy_set_header Host $http_host; proxy_read_timeout 60; proxy_connect_timeout 60; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } ```

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@GurjinderSingh commented on GitHub (Mar 5, 2021):

I have solved my same problem by adding inside location block. password protect domain with access and https enabled. now both works like well-oiled engine.

  location /theiaphp {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_pass       http://theiaphp:3000/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
  }

  location /ubuntuvnc {
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-Scheme $scheme;
    proxy_set_header X-Forwarded-Proto  $scheme;
    proxy_set_header X-Forwarded-For    $remote_addr;
    proxy_pass       http://ubuntuvnc:80/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
    proxy_http_version 1.1;
  }

@GurjinderSingh commented on GitHub (Mar 5, 2021): I have solved my same problem by adding inside location block. password protect domain with access and https enabled. now both works like well-oiled engine. ``` location /theiaphp { proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_pass http://theiaphp:3000/; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } location /ubuntuvnc { proxy_set_header Host $host; proxy_set_header X-Forwarded-Scheme $scheme; proxy_set_header X-Forwarded-Proto $scheme; proxy_set_header X-Forwarded-For $remote_addr; proxy_pass http://ubuntuvnc:80/; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $http_connection; proxy_http_version 1.1; } ```

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@MarKramMich commented on GitHub (Mar 8, 2021):

Hi
I am struggling with the same issue :( And get stuck.
my conf in NPM:
#proxy_hide_header Upgrade;
proxy_hide_header X-Powered-By;
add_header Content-Security-Policy "upgrade-insecure-requests";
add_header X-Frame-Options "SAMEORIGIN";
add_header X-XSS-Protection "1; mode=block" always;
add_header X-Content-Type-Options "nosniff" always;
add_header Cache-Control "no-transform" always;
add_header Referrer-Policy no-referrer always;
add_header X-Robots-Tag none;

location /wss {
try_files $uri @ws;
}

location @ws {
proxy_pass http://$server:8888;
proxy_set_header Host $http_host;
proxy_read_timeout 60;
proxy_connect_timeout 60;
proxy_redirect off;

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';
proxy_set_header Host $host;
proxy_cache_bypass $http_upgrade;
}

and still getting 400 error:
websocket connection failed error during websocket handshake unexpected response code 400

could please someone look at this conf ? where is the problem ?

@MarKramMich commented on GitHub (Mar 8, 2021): Hi I am struggling with the same issue :( And get stuck. my conf in NPM: #proxy_hide_header Upgrade; proxy_hide_header X-Powered-By; add_header Content-Security-Policy "upgrade-insecure-requests"; add_header X-Frame-Options "SAMEORIGIN"; add_header X-XSS-Protection "1; mode=block" always; add_header X-Content-Type-Options "nosniff" always; add_header Cache-Control "no-transform" always; add_header Referrer-Policy no-referrer always; add_header X-Robots-Tag none; location /wss { try_files $uri @ws; } location @ws { proxy_pass http://$server:8888; proxy_set_header Host $http_host; proxy_read_timeout 60; proxy_connect_timeout 60; proxy_redirect off; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } and still getting 400 error: websocket connection failed error during websocket handshake unexpected response code 400 could please someone look at this conf ? where is the problem ?

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@GurjinderSingh commented on GitHub (Mar 9, 2021):

first do you declare $server var ?

second i faced same problem with phpmyadmin you have to end proxy_pass with / .

proxy_pass http://$server:8888; >> proxy_pass http://$server:8888/;

please read :https://github.com/jc21/nginx-proxy-manager/issues/927

@GurjinderSingh commented on GitHub (Mar 9, 2021): first do you declare $server var ? second i faced same problem with phpmyadmin you have to end proxy_pass with / . proxy_pass http://$server:8888; >> proxy_pass http://$server:8888/; please read :https://github.com/jc21/nginx-proxy-manager/issues/927

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@conichonhaa commented on GitHub (Feb 27, 2022):

Is it possible to write a documentation for websocket? There's only a few article with npm and websocket. I've got a fully functional websocket but when I try to migrate from my old nginx reverse proxy to npm, I can't set the websocket part correctly

@conichonhaa commented on GitHub (Feb 27, 2022): Is it possible to write a documentation for websocket? There's only a few article with npm and websocket. I've got a fully functional websocket but when I try to migrate from my old nginx reverse proxy to npm, I can't set the websocket part correctly

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@ilisparrow commented on GitHub (Mar 28, 2023):

Hello,
In case you just need to forward sockets (in my case for streamlit), you can toggle this button :

Hope this helps someone.

@ilisparrow commented on GitHub (Mar 28, 2023): Hello, In case you just need to forward sockets (in my case for streamlit), you can toggle this button : ![image](https://user-images.githubusercontent.com/4880273/228260133-49da0236-3209-4a5a-81c8-272dc736a8e4.png) Hope this helps someone.

kerem commented

2026-02-26 06:33:40 +03:00

Author

Owner

@hybrdthry911 commented on GitHub (Mar 31, 2023):

Hello, In case you just need to forward sockets (in my case for streamlit), you can toggle this button :

Hope this helps someone.

Helped me. Must have been one of those things my eyes saw but my brain filtered out when it was right in front of me. Kept getting wss:// errors until this was toggled.

@hybrdthry911 commented on GitHub (Mar 31, 2023): > Hello, In case you just need to forward sockets (in my case for streamlit), you can toggle this button : > > ![image](https://user-images.githubusercontent.com/4880273/228260133-49da0236-3209-4a5a-81c8-272dc736a8e4.png) > > Hope this helps someone. Helped me. Must have been one of those things my eyes saw but my brain filtered out when it was right in front of me. Kept getting wss:// errors until this was toggled.

Rows
Columns

[GH-ISSUE #723] Websocket configuration #614