Issue with LiveView using Dokku – websocket failing

What is the root folder of you app? Are you serving LiveView app directly from https://evepeak.com and enduro-time is route in Phoenix router? Or is NGINX serving it from enduro-time virtual directory? Because if it’s latter LiveSocket it trying to connect to wrong route wss://evepeak.com/live in that case it should be wss://evepeak.com/enduro-time/live. I think Phoenix supports base url/path.

Hi! /enduro-time is a live route of the main application running from evepeak.com

ws connection seems established, so possibly check_origin config issue causing the 403

Hi @evadne how can you tell that there is a 403? This is my configuration with the check_origin details:

socket "/live", Phoenix.LiveView.Socket,
    websocket: [connect_info: [session: @session_options]],
    check_origin: ["http://evepeak.com", "https://evepeak.com", "ws://evepeak.com", "wss://evepeak.com"]

Hi. Possibly not it then. I got that myself when trying the endpoint.

Is nginx properly configured? I remember that I needed a file nginx.conf.sigil with something like this inside:

location ~ live/websocket {
    proxy_http_version 1.1;
    proxy_set_header Origin '';
    proxy_set_header X-Forwarded-Host $proxy_add_x_forwarded_for;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "Upgrade";
    proxy_pass  http://{{ $.APP }}-{{ $upstream_port }};
    break;
  }

Hi @egze, I did configure Nginx but I omitted the proxy_set_header Origin ... as @evadne suspected it was indeed an issue with check_origin configuration. I assumed it would be correctly set by the proxy but clearly it was not. After days of experiments now it’s solved! Thanks a lot to you all!

With dokku 0.27.1 there is no need to modify the nginx configuration. If your websocket fails to connect then you probably aren’t telling your app what domain name you’re using and so the check_origin check is failing.

You can confirm this by looking in the logs of your app for a line like “Could not check origin for Phoenix.Socket transport”.

dokku config:set your-app-name PHX_HOST=your-public-domain-name is probably all you need.

If you instead do proxy_set_header Origin ''; in the nginx file, you’re removing all origin checks, which is equivalent to setting check_origin: false. The docs advise against doing this:

If false, your app is vulnerable to Cross-Site WebSocket Hijacking (CSWSH) attacks. Only use in development, when the host is truly unknown or when serving clients that do not send the origin header, such as mobile apps.

The default liveview websockets use CSRF tokens, I think, so they’re probably not vulnerable, but it’s something to be careful about.

If your app uses liveview/websockets on multiple domains you will need to explicitly configure check_origin for your endpoint (this is the case whether or not you use dokku).

Thank you very much body. that works.