☰

Socket.io 与 Sails.js/Node.js 和 NGINX 在 SSL 上：坏网关

tag-icon • tag-icon nginx ssl node.js socket.io
Socket.io 与 Sails.js/Node.js 和 NGINX 在 SSL 上：坏网关

我刚刚开始涉足 NGINX 和 SSL。

使用 Ubuntu 16.04。

我在标准 1337 端口上运行 Sails 服务器，并刚刚使用 SSL 设置了 NGINX（使用 letsencrypt）。端口 80 重定向到 443，上游转到 Sails。

我还有一个在 8080 上监听的 Tomcat 服务器，并使用 NGINX 以相同的方式重定向。

一切正常：我可以通过 https 浏览两个服务器，无需在浏览器上使用特殊端口。

我已经将 socket.io 设置为仅使用 websockets 协议（无轮询）。这在服务器和浏览器客户端上都进行了设置。

但是，socket.io（sails.io）在浏览器中抛出了 502 错误。（轮询也给出了错误）

以下是我的 NGINX 站点 - 可用于 Sails 服务器：

upstream sails {
   server 127.0.0.1:1337 fail_timeout=0;
}

server {
   listen 80;
   listen [::]:80;
   server_name mysails.server.com;
   return 301 https://$server_name$request_uri;
}

server {
   listen 443;
   listen [::]:443 ssl http2;
   server_name mysails.server.com;
   include snippets/ssl-mysails.server.conf;
   include snippers/ssl-params.conf;
   large_client_header_buffers 8 32k;

   location / {
      proxy_pass http://sails/;
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_set_header Host $host;
      proxy_set_header Port $server_port;
      proxy_set_header X-Real-IP $remot_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-NginX-Proxy true;
      proxy_pass_request_headers on;

   }

   location /socket.io/ {
      proxy_pass http://sails/;
      proxy_http_version 1.1;
      proxy_redirect off;
      proxy_set_header Host $host;
      proxy_set_header Port $server_port;
      proxy_set_header X-Real-IP $remot_addr;
      proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
      proxy_set_header X-NginX-Proxy true;
      proxy_pass_request_headers on;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "upgrade";
      proxy_buffers 8 32k;
      proxy_buffer_size 64k;

   }   
}

和snippets/ssl-mysails.server.conf文件snippers/ssl-params.conf包含：

ssl_certificate /path/to/letsencrypt/fullchain.pem;
ssl_certificate_key /path/to/letsencrypt/privkey.pem;

和

# from https://cipherli.st/
# and https://raymii.org/s/tutorials/Strong_SSL_Security_On_nginx.html

ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
ssl_prefer_server_ciphers on;
ssl_ciphers "EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH";
ssl_ecdh_curve secp384r1;
ssl_session_cache shared:SSL:10m;
ssl_session_tickets off;
ssl_stapling on;
ssl_stapling_verify on;
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;
# Disable preloading HSTS for now.  You can use the commented out header line that includes
# the "preload" directive if you understand the implications.
#add_header Strict-Transport-Security "max-age=63072000; includeSubdomains; preload";
add_header Strict-Transport-Security "max-age=63072000; includeSubdomains";
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
ssl_dhparam /etc/ssl/certs/dhparam.pem;

有人知道发生了什么事吗……？

更新错误日志和奇怪的行为

我的 nginx 错误日志显示如下：

upstream prematurely closed connection while reading response header from upstream, client: XXXXXXXX, server: mysals.server.com, request: "GET /socket.io/?__sails_io_sdk_version=0.13.8&__sails_io_sdk_platform=browser&__sails_io_sdk_language=javascript&EIO=3&transport=websocket HTTP/1.1", upstream: "http://127.0.0.1:1337/?__sails_io_sdk_version=0.13.8&__sails_io_sdk_platform=browser&__sails_io_sdk_language=javascript&EIO=3&transport=websocket", host: "mysails.server.com"

而我的 Sails 详细日志不一致。它可能会这样说：

*verbose*: Rendering view: "homepage" (located @ "/opt/FillForm/views/homepage")
*verbose*: • using configured layout:: layout (located @ "/opt/FillForm/views/layout")
*verbose*: Rendering view: "homepage" (located @ "/opt/FillForm/views/homepage")
*verbose*: • using configured layout:: layout (located @ "/opt/FillForm/views/layout")
*verbose*: Rendering view: "fileLink" (located @ "/opt/FillForm/views/fileLink")
*verbose*: • using configured layout:: layout (located @ "/opt/FillForm/views/layout")
*verbose*: Sending 404 ("Not Found") response
*verbose*: Sending 404 ("Not Found") response
*verbose*: Rendering view: "fileLink" (located @ "/opt/FillForm/views/fileLink")
*verbose*: • using configured layout:: layout (located @ "/opt/FillForm/views/layout")
*verbose*: Sending 404 ("Not Found") response
*verbose*: Sending 404 ("Not Found") response

/opt/FillForm/views/fileLink这很奇怪，因为对视图/页面应该只有一个请求。

如果你刷新页面（F5），浏览器上的 Javascript 控制台可能会显示：

 Socket is trying to reconnect to Sails...
_-|>_-  (attempt #7)

每次尝试都会导致一系列

verbose: Rendering view: "homepage" (located @ "/opt/FillForm/views/homepage")
verbose: • using configured layout:: layout (located @ "/opt/FillForm/views/layout")

Sails 详细日志上的消息。为什么套接字请求会导致 Sails 呈现主页视图？

如果您使用忽略缓存（shift+F5）刷新，Javascript 控制台将开始显示尝试和 502 错误网关消息：

WebSocket connection to 'wss://mysqils.server.com/socket.io/?__sails_io_sdk_version=0.13.8&__sails_io_s…tform=browser&__sails_io_sdk_language=javascript&EIO=3&transport=websocket' failed: Error during WebSocket handshake: Unexpected response code: 502
        Socket is trying to reconnect to Sails...
_-|>_-  (attempt #20)

Sails 详细日志仅显示以下消息的两个实例：

verbose: Sending 404 ("Not Found") response
verbose: Sending 404 ("Not Found") response

并且它不再显示任何其他错误（不像以前的情况，每次 websocket 尝试都会导致查看呈现消息。）

在这种情况下，wss 请求似乎没有通过 Nginx 到达 Sails。

答案1

因此问题在于 NGINX sites-avalable conf 文件的配置错误。

location /socket.io/ {
      proxy_pass http://sails/;
...
}

应该

location /socket.io/ {
      proxy_pass http://sails/socket.io/;
...
}

非常基本的东西：“位置”没有转发到 proxy_pass（为什么会这样，对吧？）——所以您需要确保套接字请求被重定向到精确的套接字端点。

相关内容