Websockets not connected behind proxy

Question

This is quite common problem, but I cannot find a solution to my specific case. I'm using Glassfish 4.1.1 and my application implements Websockets.

On a client side I'm connecting to WS-server simply by:

var serviceLocation = "ws://" + window.location.host + window.location.pathname + "dialog/";
var wsocket = new WebSocket(serviceLocation + token_var);

On a server side websockets are implemented via @ServerEndpoint functionality and looks very common:

@ServerEndpoint(value = "/dialog/{token}", decoders = DialogMessageDecoder.class)
public class DialogWebsoketEndpoint {

    @OnOpen
    public void open(final Session session, @PathParam("token") final String token) { ... }
etc.
}

Everything works fine up to the moment when customer tries to connect behind proxy. Using this test: http://websocketstest.com/ I've found that computer of the customer works behind http-proxy 1.1. He cannot connect to websockets, onopen simply do not fire at all. wsoscket.readyState never become 1.

How can I tune my ServerEndpoint to make this code work even when customer is connecting behind proxy?

Thank you in advance!

UPDATE: I would provide a screenshot with websocketstest at that computer:

On my computer it seems similarly except one thing: HTTP Proxy: NO.

Answer 1

Much as the comments to the questions state, it seems the Proxy doesn't support Websockets properly.

This is a common issue (some cell-phone companies have proxies that disrupt websocket connections) and the solution is to use TLS/SSL connections.

The issue comes up mainly because some proxies "correct" (read: corrupt) the Websocket request headers.

However, when using TLS/SSL, the proxies can't read the header data (which is encrypted), causing data "pass-through" on most proxies.

This means the headers will arrive safely at the other end and the proxy will (mostly) ignore the connection... this might still cause an issue where connection timeouts are concerned, but it usually resolves the issue.

EDIT

Notice that the browsers will protect the client from mixing non-encrypted content with encrypted content. Make sure the script initiates the ws connections using the wss variant when TLS/SSL connections are used.