400 No WebSocket Upgrade header found

[Teajey]

Hello. I'm trying to add GraphQL subscriptions to my actix server. I've got everything set up, subscription endpoint with juniper_actix, etc. But I'm getting a 400 No WebSocket Upgrade header found any time I try to send a subscription, even though there is definitely an Upgrade header included in the request.

I can see that this message comes from within actix_http:

actix-web/actix-http/src/ws/mod.rs

Line 171 in 7b27493

return Err(HandshakeError::NoWebsocketUpgrade);

Request headers:

GET /subscriptions HTTP/1.1
Host: localhost:9443
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.15; rv:98.0) Gecko/20100101 Firefox/98.0
Accept: */*
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate, br
Sec-WebSocket-Version: 13
Origin: https://localhost:8443
Sec-WebSocket-Protocol: graphql-transport-ws
Sec-WebSocket-Extensions: permessage-deflate
Sec-WebSocket-Key: zl4LkzO3UWlYddAuv1SBow==
Connection: keep-alive, Upgrade
Sec-Fetch-Dest: websocket
Sec-Fetch-Mode: websocket
Sec-Fetch-Site: same-site
Pragma: no-cache
Cache-Control: no-cache
Upgrade: websocket <---- ‼️‼️

Response headers:

HTTP/1.1 400 No WebSocket Upgrade header found
Server: nginx/1.20.2
Date: Fri, 11 Mar 2022 02:43:45 GMT
Content-Length: 0
Connection: keep-alive
access-control-expose-headers: sec-fetch-site, x-forwarded-for, host, accept, sec-websocket-key, user-agent, sec-websocket-protocol, pragma, sec-fetch-dest, accept-encoding, sec-fetch-mode, sec-websocket-version, origin, cache-control, connection, sec-websocket-extensions, x-forwarded-proto, x-real-ip, accept-language
access-control-allow-origin: https://localhost:8443
access-control-allow-credentials: true
vary: Origin, Access-Control-Request-Method, Access-Control-Request-Headers

Any ideas what might be causing it? I'm completely mystified and not sure how I can debug this

[robjtede]

Connection: keep-alive, Upgrade this is not correct, you can't have both. It must be upgrade only.

[fakeshadow]

According to rfc6455:

The request MUST contain a |Connection| header field whose value MUST include the "Upgrade" token.

I don't see anywhere state other token is forbidden.

[fakeshadow]

I could be reading it wrong but from my understanding it should be legal to transfer a connection header with more values than "Upgrade" in this case "Keep-Alive, Upgrade".

And actix-http should be changed to take this in consideration and handle multiple values. If you look at hyper it determine connection close or keep-alive condition by split comma and match all token value.

[robjtede]

Sounds like it's working anyway. Well done figuring it out with the proxy. @Teajey Would be good to copy your findings into an answer on this discussion and mark it as the solution.

The RFC wording quoted states that other values are allowed, though it makes little sense to specify both upgrade and keep-alive for a WebSocket request over HTTP/1.1; in normal course you wouldn't see more than one value. We'll see about making a change regardless.

[fakeshadow]

Yes it does not make sense to do so but I believe there surely are libraries using this pattern and it's great to be compatiable when we can afford to not breaking the rules of http spec.

[robjtede]

Yep, made an issue about it: #2692
Further discussion can happen there.

[Teajey]

I found that my nginx proxy was scrapping my original Connection and Upgrade headers. So my solution for now, at least until I find a better one, is to have nginx reset the headers as close as possible to what the client originally sent:

     location / {
       proxy_pass https://api_server;

       proxy_set_header        Host $host;
       proxy_set_header        X-Real-IP $remote_addr;
       proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
       proxy_set_header        X-Forwarded-Proto $scheme;
     }
+
+    location /subscriptions {
+      proxy_pass https://api_server/subscriptions;
+
+      proxy_http_version 1.1;
+
+      proxy_set_header        Host $host:${API_PORT};
+      proxy_set_header        X-Real-IP $remote_addr;
+      proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header        X-Forwarded-Proto $scheme;
+
+      proxy_set_header      Connection "keep-alive, Upgrade";
+      proxy_set_header      Upgrade websocket;
+    }
   }

[FoRavel]

Thanks it fixed the issue for me