Safari Problem with WebSockets

26 views
Skip to first unread message

Eduardo De Castro

unread,
Aug 8, 2019, 9:25:46 AM8/8/19
to jup...@googlegroups.com

Hi,

 

I have deployed a JupyterLab instance with a nginx with SSL enabled using a self-signed certificate. It’s working on Firefox and Chrome over HTTPS, but on Safari 12.1.2 (MacOs), the web console indicates that is not possible to establish the WebSocket (WSS) connection:

 

WebSocket connection to 'wss://……' failed: Unexpected response code: 401

 

Does someone have a workaround for this issue?

 

Best Regards,

Eduardo

Afshin T. Darian

unread,
Aug 8, 2019, 9:31:02 AM8/8/19
to jup...@googlegroups.com
Hi Eduardo,

I am not 100% I understand what's going on, but it sounds a lot like the issue (in a different product) that somebody describes here:

hessu commented

Hi, it appears that some browsers do not pass over the authentication information from plain HTTP requests session to the WebSocket requests. The 401 response is coming from nginx, not hass.

To support those browsers with WebSocket API, the auth_pam directives would need to be excluded for /api/websocket URL as described in #5954, comment by #5954 (comment) – the example of adding a separate "location /api/websocket" block without auth_* directives works, although the description around it does not describe why it's needed.


If that is indeed the case, your solution might lie in a variant of this answer:

For nginx, have you tried creating a seperate location for the /api/websocket ? See http://nginx.org/en/docs/http/websocket.html for more info.

For example:

# add this to your server {}
location /api/websocket {
            proxy_pass http://[change-me-to-hass-location]/api/websocket;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }

Haven't tested this yet because I don't use a reverse proxy, but could be a logical explanation.

Strangely enough the web app on iOS (bookmark added to the home screen, webview launches in separate process) continues to work, however I cannot establish a connection using Safari or, (a freshly installed) Chrome instance on the same device.

The chances are that your "pinned" webapp in iOS is still an old version of the web ui, using the EventStream instead of websocket.



I hope that is helpful!

-Darian

--
You received this message because you are subscribed to the Google Groups "Project Jupyter" group.
To unsubscribe from this group and stop receiving emails from it, send an email to jupyter+u...@googlegroups.com.
To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/BDBA5F39-96A6-47E5-9DDC-7E6ABEC7434A%40qualtera.com.

Eduardo De Castro

unread,
Aug 8, 2019, 10:18:14 AM8/8/19
to jup...@googlegroups.com

Hi Afshin,

 

Thank you for your reply. I have tried the proposed solution and other combinations. Unfortunately, it doesn’t work.

 

Regards,

Eduardo

Afshin T. Darian

unread,
Aug 8, 2019, 10:24:01 AM8/8/19
to jup...@googlegroups.com
HI Eduardo,

Just to be clear, in JupyterLab, the websocket URL is: /api/kernels and *not* the `Location` directive in the example above. Is that the location you used?

-Darian

To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/03833530-F834-4EB0-A62A-ED13FF26BF0B%40qualtera.com.

Eduardo De Castro

unread,
Aug 8, 2019, 11:03:42 AM8/8/19
to jup...@googlegroups.com

Hi Darian,

 

I have used the correct location: /api/kernels. The issue is related to Safari, it opens and closes the connection.

Afshin T. Darian

unread,
Aug 8, 2019, 11:21:11 AM8/8/19
to jup...@googlegroups.com
If Safari is telling you that there is a 401, that means your server is returning access denied. If your server is returning access denied it means that Safari is not passing through authentication information the way other browsers are. But I am not sure what do advise.

Perhaps someone else on the group has seen this issue arise using nginx as a reverse proxy for websockets with Safari as the client. Good luck!

To view this discussion on the web visit https://groups.google.com/d/msgid/jupyter/522DDC0E-D946-49C4-B02A-651CA2071659%40qualtera.com.
Reply all
Reply to author
Forward
0 new messages