WebSocket Connection Without an Extra Port

Version

Application Scenario

Some companies enforce strict security policies on project environments and restrict which ports can be opened.

WebSocket connections often fail when only one port is opened.

Function Description

When additional WebSocket ports cannot be opened, WebSocket traffic can be forwarded to an existing open port.

This document describes how WebSocket connections can still work when only one port (8888) is opened in an environment consisting of Linux, nginx, and Tomcat.

Note: 

Starting from the FineReport project of V11.0.2 and later versions, a container-native WebSocket solution has been added. You are advised to first check if the container-native WebSocket solution can be used.

No user operation, manual configuration, or additional port is required. The system automatically uses the WebSocket implementation built into the web container for connection, and the WebSocket connection reuses the HTTP port.

Setting WebSocket Forwarding Port

Log in to the decision-making platform as the admin, choose System Management > System Setting > General, and set WebSokcet Request Port, as shown in the following figure. /

The port set in this section (port 8888 in this example) is the only external port of the project. You can set it as needed.

Note: 

1. In a cluster environment, Proxy Server Configured is automatically ticked by default. In a non-cluster environment, tick it manually. (The option indicates that nginx is already configured.)

2. If WebSocket Setting shown in the following figure is not displayed under System Management > System Setting > General on the decision-making platform, the WebSocket connection is already properly configured, requiring no further modification.

Modifying nginx.conf

In the server block in nginx.conf where nginx listens on port 8888, add a branch that matches request URLs starting with /socket.io/ and forwards requests to upstream servers. For details, see the following configurations.

...
server {
        listen 8888;#Listening port. It should be consistent with the port configured in WebSocketConfig.requestPort.
        server_name _;
        underscores_in_headers on;
        location / {
            proxy_http_version 1.1;
            proxy_pass http://FR.com;
            proxy_next_upstream http_500 http_502 http_503 http_504 error timeout invalid_header non_idempotent;
            proxy_redirect off;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Connection "";
            #proxy_set_header X-Forwarded-Proto "https";
            proxy_connect_timeout 20;
            proxy_read_timeout 1000;
            proxy_send_timeout 300;
        }
        #Requests URLs starting with /socket.io/ are matched and forwarded to upstream servers.
        location ^~ /socket.io/ {
            proxy_pass http://WBS.com;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_connect_timeout 20;
            proxy_read_timeout 1000;
            proxy_send_timeout 300;
        }
        ...
}
...

Restarting the Service

The configuration will take effect after you restart nginx and the FineReport project.

In this way, you can open only port 8888 for the report project and WebSocket connections to work normally.