Working with Proxies

1. Understanding Proxy Challenges

IssueDetail
Strip Upgrade headersOld proxies break WS
Idle timeouts30-60s common; need heartbeat
BufferingDelays small frames
TLS interceptionCorporate MITM proxies
CONNECT onlyHTTP proxies need tunnel

2. Configuring Nginx Proxy

Example: Nginx WS proxy

map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}
server {
  location /ws {
    proxy_pass http://backend;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    proxy_buffering off;
    proxy_read_timeout 3600s;
  }
}

3. Configuring Apache Proxy

Example: mod_proxy_wstunnel

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

<VirtualHost *:443>
  ProxyPass        /ws  ws://backend:8080/ws
  ProxyPassReverse /ws  ws://backend:8080/ws
</VirtualHost>
ModuleRequired
mod_proxyBase
mod_proxy_wstunnelWS support
mod_proxy_httpFor HTTP coexistence

4. Configuring HAProxy

Example: HAProxy frontend/backend

frontend https
  bind *:443 ssl crt /etc/ssl/site.pem
  acl is_ws hdr(Upgrade) -i websocket
  use_backend ws_back if is_ws
  default_backend http_back

backend ws_back
  balance source
  timeout tunnel 1h
  server ws1 10.0.0.1:8080 check
  server ws2 10.0.0.2:8080 check
DirectivePurpose
timeout tunnelWS-specific idle
balance sourceSticky by client IP
option http-server-closeAvoid keep-alive interference

5. Handling Proxy Timeouts

ProxyDefault Timeout
AWS ALB60s (configurable to 4000s)
Nginx60s
HAProxyvaries
Cloudflare100s free, 600s paid
Note: Heartbeat interval should be ≤ 80% of the shortest hop's idle timeout.

6. Implementing Proxy Authentication

MethodDetail
BasicProxy-Authorization: Basic ...
DigestChallenge-response
NTLM / KerberosCorporate Windows
mTLSClient cert

7. Using CONNECT Method

StepDetail
1Client sends CONNECT host:443 HTTP/1.1
2Proxy opens TCP tunnel to host
3200 OK → tunnel open
4Client does TLS + WS upgrade end-to-end

8. Handling Corporate Proxies

IssueMitigation
No WS supportLong-polling fallback
MITM TLSInstall corp CA
Block non-443Use 443 (wss) only
BufferingApp-level keepalive

9. Debugging Proxy Issues

ToolUse
curl --includeHeaders visible
wscatManual WS test
WiresharkFrame-level inspection
DevTools NetworkFailed handshake status

10. Testing Proxy Configuration

TestExpected
Open + sendRound-trip < 200ms
Idle 90sConnection stays open with heartbeat
1MB binaryDelivered intact
Reconnect under loadBackoff success