[Bug]: 'Error: WebSocket close with status code 1006' behind nginx proxy

[zirui]

Is there an existing issue for this?

• I have searched the existing issues

OS/Web Information

• Web Browser: edge
• Local OS: macos
• Remote OS: ubuntu
• Remote Architecture: x86
• code-server --version: 4.6.0

Steps to Reproduce

proxy with nginx:

  location /code/ {
      proxy_pass https://0.0.0.0:9997/;
      proxy_http_version 1.1;
      proxy_set_header Host $host;
      proxy_set_header Upgrade $http_upgrade;
      proxy_read_timeout 86400;
      proxy_set_header Connection $connection_upgrade;
      proxy_set_header Accept-Encoding gzip;
  }

run code-server

code-server  --cert MyCertificate.crt --cert-key MyKey.key --port 9997

2. visit from url: ${myhost}/code/

Expected

Code server opens up to home screen.

Actual

error log:

Logs

Screenshot/Video

No response

Does this issue happen in VS Code or GitHub Codespaces?

• I cannot reproduce this in VS Code.
• I cannot reproduce this in GitHub Codespaces.

Are you accessing code-server over HTTPS?

• I am using HTTP.

Notes

Why does code-server create a websocket connection with port 80? And how can this issue be solved?

The network environment of the host machine:
The port 80 has been disabled by the administrator of the host machine, only a few ports are open.

[code-asher]

It looks like it is using 80 because you are accessing the website over http. It might be better to let NGINX handle TLS, so remove --cert and --cert-key, change proxy_pass to http, give NGINX the certificate and key, then visit https://${myhost}/code/.

[zirui]

Thanks for your replay @code-asher
I'm sorry I made a mistake, the error above occurred when I visited using HTTP not HTTPS.
Then I tried the following based on your suggestion:

1. give NGINX the certificate and key

  ssl_certificate       MyCertificate.crt;
  ssl_certificate_key   MyKey.key ;

2. start code-server

code-server --log=debug --port 9997

3. visit using https:

https://${myhost}/code/

but it still went wrong.
error logs:

[code-asher]

Is this a self-signed certificate? Some browsers (like Chrome, not sure about Edge though) will have trouble connecting web sockets with self-signed certificates. If you see something like a gray or green lock then you should be OK but if not you may need to either get a certificate signed by a CA or trust the certificate on your local machine (you can do this manually or install mkcert to do it for you). You might also want to check NGINX's logs and code-server's output just in case it is an error on the server side rather than the browser.

[zirui]

Yes, it is a self-signed certificate generated by OpenSSL
I checked the nginx's logs, but didn't find any clues.
error.log:
no related logs
access.log:

10.10.6.9 - - [18/Feb/2023:16:58:06 +0800] "GET /code/stable-2062a59ca1a586d8a6e7bf483841085a94c440a4/static/extensions/git-base/dist/browser/extension.js HTTP/1.0" 404 29 "https://xxx.yy/code/stable-2062a59ca1a586d8a6e7bf483841085a94c440a4/static/out/vs/base/worker/workerMain.js" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41"
10.10.6.9 - - [18/Feb/2023:16:58:06 +0800] "GET /code/stable-2062a59ca1a586d8a6e7bf483841085a94c440a4/static/extensions/emmet/dist/browser/emmetBrowserMain.js HTTP/1.0" 404 29 "https://xxx.yy/code/stable-2062a59ca1a586d8a6e7bf483841085a94c440a4/static/out/vs/base/worker/workerMain.js" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/110.0.0.0 Safari/537.36 Edg/110.0.1587.41"

[zirui]

I have tried the following two methods:

1. create locally signed SSL certificates with mkcert
2. access through safari browser

but neither of them worked.

Is it because the 443 port of the host machine is not open? Is there an alternative solution? My machine has very strict network restrictions, and only a few ports are open.

the output logs of the Edge:
err.log

[code-asher]

Sorry for the delayed response. You will need port 443 open on the machine running NGINX. But you said you access via `https://${myhost}/code/` right? That means you are already accessing through port 443 so it should already be open. Both https:// and wss:// default to port 443. Interesting that there are no error logs from NGINX, that does suggest it might still be a certificate issue. Did you update NGINX to use the certificates generated by mkcert?

[zirui]

Sorry for the delayed response. You will need port 443 open on the machine running NGINX. But you said you access via https://${myhost}/code/ right? That means you are already accessing through port 443 so it should already be open. Both https:// and wss:// default to port 443. Interesting that there are no error logs from NGINX, that does suggest it might still be a certificate issue. Did you update NGINX to use the certificates generated by mkcert?

Hi,
After some test on websocket connections, I found the problem:
The security gateway on the host machine does not enable WebSocket when forwarding domain name, only HTTP/HTTPS requests will be forwarded.
Therefore, there are always WebSocket connection errors in the browser front-end:
[initial[xxx:443] socketFactory.connect() failed or timed out"

Due to security concerns, the administrator of the host machine will not allow WebSocket forwarding requests. Are there any alternative solutions?

[code-asher]

Ahh that makes sense! There is currently no way to use code-server without web sockets so you would need to figure out some other way to get the web sockets to connect. For example if you are able to use SSH you could access code-server through an SSH tunnel. ``` ssh -N -L 8080:127.0.0.1:8080 [user]@<instance-ip> ``` Then visit `localhost:8080`.

[zirui]

Ahh that makes sense! There is currently no way to use code-server without web sockets so you would need to figure out some other way to get the web sockets to connect. For example if you are able to use SSH you could access code-server through an SSH tunnel. ssh -N -L 8080:127.0.0.1:8080 [user]@<instance-ip> Then visit localhost:8080.

Unfortunately, the direct SSH connection to the remote host has also been blocked by the administrator (requiring connection through a jump host and do some authentication), so SSH tunnel won't work.
Anyway, thank you for your reply.

[SimonTod]

I can confirm that this issue is present since 4.10.1.
4.10.0 and below work fine.

[code-asher]

@SimonTod 4.10.1 added a security check that uses the host and origin headers; do you have code-server behind a reverse proxy and does it forward the host header?

[TomBraun02]

In my installation with Nginx-Proxy the following works with 4.11.0

location / {
proxy_pass http://127.0.0.1:3443/;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Accept-Encoding gzip;
proxy_set_header Origin https://$host;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
}

docker run -it --name code-server -p 127.0.0.1:3443:8080 -v "$HOME/.config:/home/coder/.config" -v "$PWD:/home/coder/project" -u "$(id -u):$(id -g)" -e "DOCKER_USER=$USER" codercom/code-server:latest

[code-asher]

That makes sense but do keep in mind that if you are always setting the origin to the host then you are bypassing the security check. However the exploit only happens on older browsers that do not support SameSite cookies and attacks across sub-domains that share the same root domain so if neither of these apply to you then there should be no problem.