# Secure web socket through reverse proxy

**URL:** <https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620>\
**Category:** Help!\
**Created:** [April 18, 2023, 8:54am UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620 "2023-04-18T08:54:22Z")\
**Posts on this page:** 7\
**Page:** 1

<div class="post-metadata">

**Author:** ![Kasper](https://avatars.discourse-cdn.com/v4/letter/k/eada6e/32.png) [@Kasper](https://discourse.haproxy.org/u/Kasper)\
**Post date:** [April 18, 2023, 8:54am UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/1 "2023-04-18T08:54:22Z")

</div>

Hey,  
I am new to HAProxy and working with sockets in general. I have trouble hole-punching through the proxy to the endpoint that starts up the socket. As of now, I am not even sure the problem is Origin related, which initially thought it was.

The setup:

Postman → Firewall (HaProxy) → Server  
Between the client and Firewall the connection has SSL.  
Between the Firewall and server there is no SSL

Is this set-up even possible? I mean is it necessary for the socket (wss) to have an SSL connection directly from client to server?

---

<div class="post-metadata">

**Author:** ![stormrover](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/stormrover/32/1847_2.png) [@stormrover](https://discourse.haproxy.org/u/stormrover)\
**Post date:** [April 20, 2023, 9:05pm UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/2 "2023-04-20T21:05:21Z")

</div>

It’s possible as long as your application (server) is OK with it. Most applications are. Some are not.

---

<div class="post-metadata">

**Author:** ![Kasper](https://avatars.discourse-cdn.com/v4/letter/k/eada6e/32.png) [@Kasper](https://discourse.haproxy.org/u/Kasper)\
**Post date:** [April 23, 2023, 8:43pm UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/3 "2023-04-23T20:43:58Z")

</div>

As of now, the server accepts cors from all clients until we go into production.  
I might be wrong, but it seems the problem is, that when the connection is upgraded from HTTP to ws the reverse proxy doesn’t allow the data to go through and I receive error code 400 - where I expect to receive 101. But I have absolutely no clue how to fix the issue.

---

<div class="post-metadata">

**Author:** ![stormrover](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/stormrover/32/1847_2.png) [@stormrover](https://discourse.haproxy.org/u/stormrover)\
**Post date:** [April 23, 2023, 9:57pm UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/4 "2023-04-23T21:57:45Z")

</div>

> **[Websockets Load Balancing With HAProxy](https://www.haproxy.com/blog/websockets-load-balancing-with-haproxy)**
>
> HTTP protocol is connection-less and only the client can request information from a server. In any case, a server can contact a client. Furthermore...

> Fortunately, **HAProxy** embeds all you need to load-balance properly **websockets** …

I have backend servers that require websockets, and there’s no special configuration to support it. Occasionally, I come across an app that requires a specific header to be written, but that’s rare and very application-specific.

---

<div class="post-metadata">

**Author:** ![Kasper](https://avatars.discourse-cdn.com/v4/letter/k/eada6e/32.png) [@Kasper](https://discourse.haproxy.org/u/Kasper)\
**Post date:** [April 24, 2023, 12:30am UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/5 "2023-04-24T00:30:14Z")

</div>

First of all, thanks a lot for the replies, it means a lot. 🙂

> [@stormrover](#):
>
> I have backend servers that require websockets, and there’s no special configuration to support it.

That’s what I thought as well, but I began doubting it since nothing worked.

The only difference between my setup and the one that you linked is that I have HTTPS on the front end (certificate from Cloudflare).

---

<div class="post-metadata">

**Author:** ![stormrover](https://sea2.discourse-cdn.com/flex016/user_avatar/discourse.haproxy.org/stormrover/32/1847_2.png) [@stormrover](https://discourse.haproxy.org/u/stormrover)\
**Post date:** [April 24, 2023, 1:56am UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/6 "2023-04-24T01:56:20Z")

</div>

> [@Kasper](#):
>
> The only difference between my setup and the one that you linked is that I have HTTPS on the front end (certificate from Cloudflare).

Yep, I use Cloudflare in front of mine as well. Shouldn’t hurt a thing.

If it works without HAProxy, see if there are any missing headers. Check the logs from HAProxy to see if maybe it’s just a routing issue or a seemingly unrelated misconfig. Outside of that, it might be worth reaching out to tthe community around the app.

---

<div class="post-metadata">

**Author:** ![Kasper](https://avatars.discourse-cdn.com/v4/letter/k/eada6e/32.png) [@Kasper](https://discourse.haproxy.org/u/Kasper)\
**Post date:** [April 24, 2023, 5:07pm UTC](https://discourse.haproxy.org/t/secure-web-socket-through-reverse-proxy/8620/7 "2023-04-24T17:07:30Z")

</div>

> [@stormrover](#):
>
> If it works without HAProxy, see if there are any missing headers.

It works fine when I am on LAN net and request the local address of the server. So I assume that the headers are configured correctly.

But you are right, the next logical step is to check the logs to ensure that this is in fact not just a routing issue.