Working with Proxies
1. Understanding Proxy Challenges
| Issue | Detail |
| Strip Upgrade headers | Old proxies break WS |
| Idle timeouts | 30-60s common; need heartbeat |
| Buffering | Delays small frames |
| TLS interception | Corporate MITM proxies |
| CONNECT only | HTTP proxies need tunnel |
2. Configuring Nginx Proxy
Example: Nginx WS proxy
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
server {
location /ws {
proxy_pass http://backend;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
proxy_buffering off;
proxy_read_timeout 3600s;
}
}
3. Configuring Apache Proxy
Example: mod_proxy_wstunnel
LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so
<VirtualHost *:443>
ProxyPass /ws ws://backend:8080/ws
ProxyPassReverse /ws ws://backend:8080/ws
</VirtualHost>
| Module | Required |
mod_proxy | Base |
mod_proxy_wstunnel | WS support |
mod_proxy_http | For HTTP coexistence |
4. Configuring HAProxy
Example: HAProxy frontend/backend
frontend https
bind *:443 ssl crt /etc/ssl/site.pem
acl is_ws hdr(Upgrade) -i websocket
use_backend ws_back if is_ws
default_backend http_back
backend ws_back
balance source
timeout tunnel 1h
server ws1 10.0.0.1:8080 check
server ws2 10.0.0.2:8080 check
| Directive | Purpose |
timeout tunnel | WS-specific idle |
balance source | Sticky by client IP |
option http-server-close | Avoid keep-alive interference |
5. Handling Proxy Timeouts
| Proxy | Default Timeout |
| AWS ALB | 60s (configurable to 4000s) |
| Nginx | 60s |
| HAProxy | varies |
| Cloudflare | 100s free, 600s paid |
Note: Heartbeat interval should be ≤ 80% of the shortest hop's idle timeout.
6. Implementing Proxy Authentication
| Method | Detail |
| Basic | Proxy-Authorization: Basic ... |
| Digest | Challenge-response |
| NTLM / Kerberos | Corporate Windows |
| mTLS | Client cert |
7. Using CONNECT Method
| Step | Detail |
| 1 | Client sends CONNECT host:443 HTTP/1.1 |
| 2 | Proxy opens TCP tunnel to host |
| 3 | 200 OK → tunnel open |
| 4 | Client does TLS + WS upgrade end-to-end |
8. Handling Corporate Proxies
| Issue | Mitigation |
| No WS support | Long-polling fallback |
| MITM TLS | Install corp CA |
| Block non-443 | Use 443 (wss) only |
| Buffering | App-level keepalive |
9. Debugging Proxy Issues
| Tool | Use |
| curl --include | Headers visible |
| wscat | Manual WS test |
| Wireshark | Frame-level inspection |
| DevTools Network | Failed handshake status |
10. Testing Proxy Configuration
| Test | Expected |
| Open + send | Round-trip < 200ms |
| Idle 90s | Connection stays open with heartbeat |
| 1MB binary | Delivered intact |
| Reconnect under load | Backoff success |