-
-
Notifications
You must be signed in to change notification settings - Fork 27k
Proxying WebSocket requests is broken #10878
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Labels
Comments
treuherz
added a commit
to treuherz/create-react-app
that referenced
this issue
Jul 11, 2022
Similar to CORS controls, WebSocket servers are often (see below) configured to check the Origin header of incoming requests. The config for the HTTP proxy overwrites requests' Origin header to prevent issues with CORS, but didn't previously do the same thing for WebSockets, as they are controlled by a different config key. Fixes facebook#10878
Related to #5280 |
treuherz
added a commit
to treuherz/create-react-app
that referenced
this issue
Sep 12, 2022
Similar to CORS controls, WebSocket servers are often (see below) configured to check the Origin header of incoming requests. The config for the HTTP proxy overwrites requests' Origin header to prevent issues with CORS, but didn't previously do the same thing for WebSockets, as they are controlled by a different config key. Fixes facebook#10878
treuherz
added a commit
to treuherz/create-react-app
that referenced
this issue
Apr 3, 2024
Similar to CORS controls, WebSocket servers are often (see below) configured to check the Origin header of incoming requests. The config for the HTTP proxy overwrites requests' Origin header to prevent issues with CORS, but didn't previously do the same thing for WebSockets, as they are controlled by a different config key. Fixes facebook#10878
treuherz
added a commit
to treuherz/create-react-app
that referenced
this issue
Apr 3, 2024
Similar to CORS controls, WebSocket servers are often (see below) configured to check the Origin header of incoming requests. The config for the HTTP proxy overwrites requests' Origin header to prevent issues with CORS, but didn't previously do the same thing for WebSockets, as they are controlled by a different config key. Fixes facebook#10878
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Describe the bug
Setting the
proxy
field inpackage.json
proxies normal HTTP requests and WebSocket requests.For normal requests, the
Origin
header is patched to equal the target host (added in #1212).For websocket requests, the
onProxyReq
hook is not executed and thus the originalOrigin
is sent to the target server. The target server will likely reject the request becauseHost
andOrigin
mismatch (Gorilla websockts in my case). To also patchOrigin
for websocket requests, theonProxyReqWs
hook has to be specified additionally.Steps to reproduce
console.log
in theonProxyReq
callback mentioned above.yarn start
any created project with a configured proxyonProxyReqWs
is called for websocket connections.Expected behavior
Origin
andHost
are equal for proxied websocket requests (e.g.http://localhost:8080
).Actual behavior
Origin
is the original header sent by the browser (e.g.http://localhost:3000
) whileHost
is changed (e.g.http://localhost:8080
).--
Note: I'd have sent a patch, but I refuse to sign the CLA.
The text was updated successfully, but these errors were encountered: