使用Apache httpd 2.4.6和Tomcat 8配置安全的WebSockets

Question

我尝试使用httpd代理和反向代理配置websockets，但似乎无法正常工作。如果我直接使用tomcat服务器，一切都很好，但如果通过apache httpd调用它，则响应状态为200。这意味着apache httpd无法解释websocket请求并切换协议，对吗？

这是我的应用程序的httpd配置：

LoadModule proxy_wstunnel_module modules/mod_proxy_wstunnel.so

Listen 443 https


SSLPassPhraseDialog exec:/usr/libexec/httpd-ssl-pass-dialog

SSLSessionCache         shmcb:/run/httpd/sslcache(512000)
SSLSessionCacheTimeout  300

SSLRandomSeed startup file:/dev/urandom  256
SSLRandomSeed connect builtin

SSLCryptoDevice builtin


<VirtualHost 10.224.130.50:80>

    ServerName myhost
    Redirect permanent / https://myhost/

</VirtualHost>

<VirtualHost 10.224.130.50:443>

    ServerName myhost
    ErrorLog logs/myhost.error.log
    CustomLog logs/myhost.access.log common

    ProxyPass /ws/       wss://localhost:8443/ws/ retry=0
    ProxyPassReverse /ws/ wss://localhost:8443/ws/ retry=0

    ProxyPass / https://myhost:8443/ connectiontimeout=600 timeout=1200
    ProxyPassReverse / https://myhost:8443/


    SSLEngine on
    SSLProtocol all -SSLv2 -SSLv3
    SSLCipherSuite ALL:!ADH:!EXPORT:!SSLv2:RC4+RSA:+HIGH:+MEDIUM:+LOW
    SSLProxyEngine on
        SSLProxyVerify none 
        SSLProxyCheckPeerCN off
        SSLProxyCheckPeerName off
        SSLProxyCheckPeerExpire off
    SSLCertificateFile    "/etc/pki/tls/certs/myhost.cer"
    SSLCertificateKeyFile "/etc/pki/tls/private/myhost.key"

</VirtualHost>

以下是Apache Tomcat的连接器配置：

<Connector port="8443" protocol="HTTP/1.1" SSLEnabled="true"
               maxThreads="150" scheme="https" secure="true"
               clientAuth="false" sslProtocol="TLS" 
           keystoreFile="/root/.keystore"
           keystorePass="password" />

- spauny

Answer 1

我认为问题可能出在斜杠上：

注意：一定要严格注意斜杠“/”或缺失！WebSocket URL端点 ProxyPass /ws/ wss://localhost:8443/ws ProxyPassReverse /ws/ wss://localhost:8443/ws 更多信息请参见： 使用Apache隧道安全WebSocket连接

- Jacob Margason

---

抱歉，我尝试了加和不加斜杠的方式……但还是不行……我试着按照文档操作，但没有任何结果……问题在于有时会出现200错误，这意味着httpd进行了重定向，但不是正确的方式，对吗？ - spauny

你能给我展示请求和响应头吗？ - Jacob Margason

Answer 2

这对我有用，但由于Java Spring框架在我的内部应用程序中，我需要添加一行附加代码。

以下是完整的解决方案，作为代理文件：

<Location /outside-app>
    # WEBSOCKET
    Header always add "Access-Control-Allow-Origin" "*"
    ProxyPass wss://internal.company.com:11111/application

    RewriteEngine on
    Require all granted
    RewriteCond %{HTTP:UPGRADE} ^WebSocket$ [NC]
    RewriteCond %{HTTP:CONNECTION} Upgrade$ [NC]
    RewriteRule .* https://internal.company.com:11111/application/$1 [P,L]

    # REVERSE PROXY
    ProxyPass https://internal.company.com:11111/application
    ProxyPassReverse https://internal.company.com:11111/application
</Location>

- Mark SMith