详解Nginx反向代理WebSocket响应403的解决办法
在Nginx反向代理一个带有WebSocket功能的SpringWeb程序（源代码地址）时，发现访问WebSocket接口时总是出现403响应，Nginx的配置参考的是官方文档:
http{
//ssl相关配置...
map$http_upgrade$connection_upgrade{
defaultupgrade;
''close;
}
server{
listen8020;
location/ws{
proxy_passhttp://some-ip:8080;
proxy_http_version1.1;
proxy_set_headerUpgrade$http_upgrade;
proxy_set_headerConnection$connection_upgrade;
}
}
}
唯一不同的是我们的Nginx配置了https。
于是打开Spring日志查看直接访问和通过Nginx访问的差别。
直接访问的日志：
DEBUG...o.s.web.servlet.DispatcherServlet:DispatcherServletwithname'dispatcherServlet'processingGETrequestfor[/ws/gs-guide-websocket/786/kz0qai5l/websocket]
DEBUG...s.w.s.m.m.a.RequestMappingHandlerMapping:Lookinguphandlermethodforpath/gs-guide-websocket/786/kz0qai5l/websocket
DEBUG...s.w.s.m.m.a.RequestMappingHandlerMapping:Didnotfindhandlermethodfor[/gs-guide-websocket/786/kz0qai5l/websocket]
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:Matchingpatternsforrequest[/gs-guide-websocket/786/kz0qai5l/websocket]are[/gs-guide-websocket/**]
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:URITemplatevariablesforrequest[/gs-guide-websocket/786/kz0qai5l/websocket]are{}
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:Mapping[/gs-guide-websocket/786/kz0qai5l/websocket]toHandlerExecutionChainwithhandler[org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler@307f6b8c]and1interceptor
DEBUG...o.s.web.servlet.DispatcherServlet:Last-Modifiedvaluefor[/ws/gs-guide-websocket/786/kz0qai5l/websocket]is:-1
DEBUG...o.s.web.cors.DefaultCorsProcessor:SkipCORSprocessing:requestisfromsameorigin
DEBUG...o.s.w.s.s.t.h.DefaultSockJsService:Processingtransportrequest:GEThttp://localhost:8080/ws/gs-guide-websocket/786/kz0qai5l/websocket
DEBUG...o.s.web.servlet.DispatcherServlet:NullModelAndViewreturnedtoDispatcherServletwithname'dispatcherServlet':assumingHandlerAdaptercompletedrequesthandling
DEBUG...o.s.web.servlet.DispatcherServlet:Successfullycompletedrequest
通过Nginx访问的日志：
DEBUG...o.s.web.servlet.DispatcherServlet:DispatcherServletwithname'dispatcherServlet'processingGETrequestfor[/ws/gs-guide-websocket/297/jp1c3ab5/websocket]
DEBUG...s.w.s.m.m.a.RequestMappingHandlerMapping:Lookinguphandlermethodforpath/gs-guide-websocket/297/jp1c3ab5/websocket
DEBUG...s.w.s.m.m.a.RequestMappingHandlerMapping:Didnotfindhandlermethodfor[/gs-guide-websocket/297/jp1c3ab5/websocket]
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:Matchingpatternsforrequest[/gs-guide-websocket/297/jp1c3ab5/websocket]are[/gs-guide-websocket/**]
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:URITemplatevariablesforrequest[/gs-guide-websocket/297/jp1c3ab5/websocket]are{}
DEBUG...o.s.w.s.s.s.WebSocketHandlerMapping:Mapping[/gs-guide-websocket/297/jp1c3ab5/websocket]toHandlerExecutionChainwithhandler[org.springframework.web.socket.sockjs.support.SockJsHttpRequestHandler@307f6b8c]and1interceptor
DEBUG...o.s.web.servlet.DispatcherServlet:Last-Modifiedvaluefor[/ws/gs-guide-websocket/297/jp1c3ab5/websocket]is:-1
DEBUG...o.s.w.s.s.t.h.DefaultSockJsService:Processingtransportrequest:GEThttp://localhost:8080/ws/gs-guide-websocket/297/jp1c3ab5/websocket
DEBUG...o.s.w.s.s.s.OriginHandshakeInterceptor:Handshakerequestrejected,Originheadervaluehttps://some-host.comnotallowed
DEBUG...o.s.w.s.s.s.HandshakeInterceptorChain:org.springframework.web.socket.server.support.OriginHandshakeInterceptor@25ce6ad4returnsfalsefrombeforeHandshake-precludinghandshake
DEBUG...o.s.web.servlet.DispatcherServlet:NullModelAndViewreturnedtoDispatcherServletwithname'dispatcherServlet':assumingHandlerAdaptercompletedrequesthandling
DEBUG...o.s.web.servlet.DispatcherServlet:Successfullycompletedrequest
注意到直接访问的日志里有这么一条：
DEBUG...o.s.web.cors.DefaultCorsProcessor:SkipCORSprocessing:requestisfromsameorigin
通过Nginx访问的日志里有这么一条：
DEBUG...o.s.w.s.s.s.OriginHandshakeInterceptor :Handshakerequestrejected,Originheadervaluehttps://some-host.comnotallowed
然后Google查询相关解决办法，找到github上的这个issue，所以只需要修改Nginx的配置，添加proxy_set_headerOrigin"";就行了：
http{
//ssl相关配置...
map$http_upgrade$connection_upgrade{
defaultupgrade;
''close;
}
server{
listen8020;
location/ws{
proxy_passhttp://some-ip:8080;
proxy_http_version1.1;
proxy_set_headerUpgrade$http_upgrade;
proxy_set_headerConnection$connection_upgrade;
proxy_set_headerOrigin"";
}
}
}
以上就是本文的全部内容，希望对大家的学习有所帮助，也希望大家多多支持毛票票。