I decided to check some files in the config directory. prod.exs looks like this:

use Mix.Config

config :my_app, MyAppWeb.Endpoint,
  load_from_system_env: true,
  url: [host: "example.com", port: 80],
  cache_static_manifest: "priv/static/cache_manifest.json"

config :logger, level: :info

import_config "prod.secret.exs"

I’m not sure if there is any significance to url: [host: "example.com", port: 80], – I’m just running the app on some random AWS domain at the moment.

Would adjusting anything in this file help resolve the 403 I’m getting when trying to connect via websocket?

Ultimately I will want this app to be accessible via websockets from multiple domains – at least a dozen or so – do I have to list all these domains somewhere?

You probably want to set the check_origin option. By default I believe its whatever protocol, host, and port you set your host to. You’ll need to add any additional hosts to it there.

Thanks, @karmajunkie – I have set check_origin to false in both my user_socket.ex file as follows:

transport :websocket, Phoenix.Transports.WebSocket, check_origin: false

and also in my prod.exs file as follows:

config :my_app, MyAppWeb.Endpoint,
  load_from_system_env: true,
  # url: [host: "example.com", port: 80],
  check_origin: false,
  cache_static_manifest: "priv/static/cache_manifest.json"

Is there any other place where I would need to set check_origin to false?

You’ll probably want to do that in your socket transport as well, see options on the transport documentation: https://hexdocs.pm/phoenix/Phoenix.Transports.WebSocket.html#content

Isn’t this line doing it on the socket transport as well?

transport :websocket, Phoenix.Transports.WebSocket, check_origin: false

Yep, i missed that in your earlier message. Those are the only places you’d need to set it AFAIK. If its still an issue you’ll probably want to try to create a minimal reproduction repo and post a link here or ask on the slack phoenix channel.

Looking at your error, if you’re getting a 403 it may also be your authentication mechanism. Have you got any plugs like guardian that might be returning the 403 before your socket authenticates? You said earlier that you’d removed the Basic auth, so if that’s your only authentication you probably shouldn’t be getting a 403.

From a security perspective, I would defintely not recommend disabling the origin check. It’s there for a reason, and disabling it to “just make it work” isn’t the right way to go.

IF your issue has to do with the origin, make sure to provide a whitelist of allowed origins, instead of completely disabling the check.

@matiso Yes, my intention is to add the security back in one step at a time, but first I just want to be able to connect to my websocket.

Did you ever solve this? I am having the same problem. Websocket works on localhost but get 403 Forbidden when deployed on DigitalOcean in a Docker container.