[BUG] WebSocket Configuration - AutoConf

[KWardOrbiner]

[BUG] WebSocket Configuration - AutoConf

[KWardOrbiner]

Hello again.
For people that struggle with implementing websocket in their bunkerweb multiple application in autoconf setup.
After lot of trials and errors, I have managed to find a configuration that sets up the right headers.
Here's a snippets of bunkerweb autoconf docker-compose:
bunkerweb: image: bunkerity/bunkerweb:1.5.5 ports: - 80:8080 - 443:8443 labels: - "bunkerweb.INSTANCE=yes" environment: - SERVER_NAME=app.myapp.com - DATABASE_URI=mariadb+pymysql://bwUser:bwPassword@bunkerweb-mariadb:3306/bwDB - USE_REVERSE_PROXY=yes - AUTOCONF_MODE=yes - MULTISITE=yes - AUTO_LETS_ENCRYPT=yes - [email protected] - USE_LETS_ENCRYPT_STAGING=no - API_WHITELIST_IP=127.0.0.0/8 10.20.30.0/24 - MAX_CLIENT_SIZE=100m networks: - bw-universe - bw-services
Here's the issue is that we should not add the tag : REVERSE_PROXY_WS=yes in this configuration.
And for my app docker-compose
`version: '3.8'
services:
frontend:
build:
context: ./client
dockerfile: Dockerfile
args:
customAPP Arguments
networks:
- bw-services
labels:
- "bunkerweb.SERVER_NAME=app.myapp.com"
- "bunkerweb.USE_REVERSE_PROXY=yes"
- "bunkerweb.REVERSE_PROXY_URL=/"
- "bunkerweb.REVERSE_PROXY_HOST=http://frontend:80"
- "bunkerweb.REVERSE_PROXY_WS=yes"

backend:
build:
context: ./server
dockerfile: Dockerfile
env_file:
myapp envfile
environment:
#myapp database host
volumes:
#my app volumes
networks:
- myapp-network
- bw-services
labels:
- "bunkerweb.SERVER_NAME=app.myapp.com"
- "bunkerweb.USE_REVERSE_PROXY=yes"
- "bunkerweb.REVERSE_PROXY_HOST_1=http://backend:7000"
- "bunkerweb.REVERSE_PROXY_URL_1=/api/"
- "bunkerweb.REVERSE_PROXY_HOST_2=http://backend:7000"
- "bunkerweb.REVERSE_PROXY_URL_2=/socket.io/"
- "bunkerweb.REVERSE_PROXY_WS_2=yes"
- "bunkerweb.REVERSE_PROXY_URL_3=/files/"
- "bunkerweb.REVERSE_PROXY_HOST_3=http://backend:7000"'

The nginx autoconf is generated appropriately.
But my issue with websocket implementation (using socket.io) is still producing 403 (forbidden) on the post, 429 (too many requests) and then the badbehavior kicks in and bans the client IP.
It comes from how socket.io works.
The post gets banned by the implementation of ModSecurity from bunkerweb:
The warning generated by ModSecurity indicates that the text/plain content type sent by the Socket.IO client does not match the allowed list of content types configured in the policy.
I'll need to tweak the ModSecurity to make it work with my socket.io implementation

[KWardOrbiner]

Hello.
To finish this topic for others.

Modsecurity blocks http request in plain text because of security measures but that's how it is done in socket.io.
So I have added an exception to ModSecurity using Custom Configuration with files.
I set-up a file:
SecRule REQUEST_FILENAME "@beginswith /socket.io/"
"id:900000,
phase:1,
pass,
nolog,
ctl:ruleRemoveById=920420"
Then I have added a greater rate limit for my socket.io:
' - "bunkerweb.REVERSE_PROXY_HOST_2=http://backend:7000"
- "bunkerweb.REVERSE_PROXY_URL_2=/socket.io/"
- "bunkerweb.REVERSE_PROXY_WS_2=yes"
- "bunkerweb.LIMIT_REQ_URL_2=/socket.io/"
- "bunkerweb.LIMIT_REQ_RATE_2=30r/s" '

Not straight forward implementation.