Accessing bokeh-server via Nginx pass-through proxy

Hi all.

So, I’m attempting to make bokeh-server accessible via an Nginx proxy. I’m running the server with the default options, so it listens on localhost:5006.

Then, in the nginx config, I have:

listen 443 default_server;

ssl on;

ssl_certificate /etc/nginx/ssl/server.crt;

ssl_certificate_key /etc/nginx/ssl/server.key;

    server_name  example.com;

    location /bokeh {

	 proxy_cache off;

	 proxy_pass http://localhost:5006; 

	 proxy_cookie_domain localhost example.com;

	 sub_filter 'http://localhost:5006' 'https://example.com';

    }

    location /static {

       # .. same as above

    }

It works fine if I access it via http://example:5006. Now, when I access https://example.com/bokeh I see the following output in Chome’s Javascript console:

Bokeh: setting prefix to https://example.com/ bokeh.js:68001

Bokeh: setting ws_conn_string to: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

[blocked] The page at ‘https://example.com/bokeh/’ was loaded over HTTPS, but ran insecure content from ‘ws://localhost:5007/bokeh/sub/’: this content should also be loaded over HTTPS.

bokeh.js:68635

Bokeh: websocket creation failed for connection string: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS. bokeh.js:1723

Uncaught TypeError: Cannot set property ‘onopen’ of undefined bokeh.js:68642

So, I see a few issues with this setup: a) the JS is attempting to access ws://localhost instead of ws://example.com, and b) it isn’t using a secure connection, c) It is accessing port 5007.

This is my first time configuring nginx.

Does anyone familiar with nginx or with experience proxying bokeh-server have any pointers regarding configuring nginx or any bokeh-server options to achieve proxying?

Thanks!

-David

We overlook this issue, David, sorry about that… @Hugo, do you have some comments on this?

I guess this comes from the discussion at https://github.com/bokeh/bokeh/issues/1383

Damian

···

On Tue, Nov 18, 2014 at 11:45 AM, David Jung [email protected] wrote:

Hi all.

So, I’m attempting to make bokeh-server accessible via an Nginx proxy. I’m running the server with the default options, so it listens on localhost:5006.

Then, in the nginx config, I have:

listen 443 default_server;

ssl on;

ssl_certificate /etc/nginx/ssl/server.crt;

ssl_certificate_key /etc/nginx/ssl/server.key;

    server_name  [example.com](http://example.com);
    location /bokeh {
   proxy_cache off;
   proxy_pass [http://localhost:5006](http://localhost:5006); 
   proxy_cookie_domain localhost [example.com](http://example.com);
   sub_filter '[http://localhost:5006](http://localhost:5006)' '[https://example.com](https://example.com)';
    }
    location /static {
       # .. same as above
    }

It works fine if I access it via http://example:5006. Now, when I access https://example.com/bokeh I see the following output in Chome’s Javascript console:

Bokeh: setting prefix to https://example.com/ bokeh.js:68001

Bokeh: setting ws_conn_string to: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

[blocked] The page at ‘https://example.com/bokeh/’ was loaded over HTTPS, but ran insecure content from ‘ws://localhost:5007/bokeh/sub/’: this content should also be loaded over HTTPS.

bokeh.js:68635

Bokeh: websocket creation failed for connection string: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS. bokeh.js:1723

Uncaught TypeError: Cannot set property ‘onopen’ of undefined bokeh.js:68642

So, I see a few issues with this setup: a) the JS is attempting to access ws://localhost instead of ws://example.com, and b) it isn’t using a secure connection, c) It is accessing port 5007.

This is my first time configuring nginx.

Does anyone familiar with nginx or with experience proxying bokeh-server have any pointers regarding configuring nginx or any bokeh-server options to achieve proxying?

Thanks!

-David

You received this message because you are subscribed to the Google Groups “Bokeh Discussion - Public” group.

To unsubscribe from this group and stop receiving emails from it, send an email to [email protected].

To post to this group, send email to [email protected].

To view this discussion on the web visit https://groups.google.com/a/continuum.io/d/msgid/bokeh/dd2ff9b8-7596-46c0-8b86-57d710c565ac%40continuum.io.

For more options, visit https://groups.google.com/a/continuum.io/d/optout.

there should be a --ws-url option which will override what bokeh
thinks the websocket url is

However - are you using an nginx that proxies websockets?  That's

the other issue. Last time I tried (a year ago) the nginx websocket
proxying support was not that great - lots of dropped connections.
I’ve used haproxy myself and that has worked pretty well

···

On 11/25/2014 03:38 PM, Damian Avila
wrote:

    We overlook this issue, David, sorry about

that… @Hugo, do you have some comments on this?

I guess this comes from the discussion at https://github.com/bokeh/bokeh/issues/1383

Damian

      On Tue, Nov 18, 2014 at 11:45 AM, David

Jung [email protected]
wrote:

Hi all.

            So, I'm attempting to make bokeh-server accessible

via an Nginx proxy. I’m running the server with the
default options, so it listens on localhost:5006.

Then, in the nginx config, I have:

                listen 443

default_server;

ssl on;

               ssl_certificate

/etc/nginx/ssl/server.crt;

               ssl_certificate_key

/etc/nginx/ssl/server.key;

server_name example.com;

location /bokeh {

proxy_cache
off;

proxy_pass
http://localhost:5006;

                proxy_cookie_domain localhost [example.com](http://example.com);

sub_filter
'http://localhost:5006
https://example.com’;

    }
                      location

/static {

                         # ..

same as above

    }

It works fine if I access it via http://example:5006 . Now, when I
access https://example.com/bokeh
I see the following output in Chome’s Javascript
console:

                Bokeh: setting

prefix to https://example.com/
bokeh.js:68001

                Bokeh: setting

ws_conn_string to: bokeh.js:1723

                [blocked] The

page at 'https://example.com/bokeh/
was loaded over HTTPS, but ran insecure content from
‘’: this content
should also be loaded over HTTPS.

bokeh.js:68635

                Bokeh:

websocket creation failed for connection string:
bokeh.js:1723

                Bokeh:  -

SecurityError: Failed to construct ‘WebSocket’: An
insecure WebSocket connection may not be initiated
from a page loaded over HTTPS. bokeh.js:1723

                Uncaught

TypeError: Cannot set property ‘onopen’ of undefined
bokeh.js:68642

            So, I see a few issues with this setup: a) the JS is

attempting to access instead of , and b) it isn’t using
a secure connection, c) It is accessing port 5007.

This is my first time configuring nginx.

            Does anyone familiar with nginx or with experience

proxying bokeh-server have any pointers regarding
configuring nginx or any bokeh-server options to achieve
proxying?

Thanks!

-David

            --

            You received this message because you are subscribed to

the Google Groups “Bokeh Discussion - Public” group.

            To unsubscribe from this group and stop receiving emails

from it, send an email to [email protected].

            To post to this group, send email to [email protected].

            To view this discussion on the web visit [https://groups.google.com/a/continuum.io/d/msgid/bokeh/dd2ff9b8-7596-46c0-8b86-57d710c565ac%40continuum.io](https://groups.google.com/a/continuum.io/d/msgid/bokeh/dd2ff9b8-7596-46c0-8b86-57d710c565ac%40continuum.io?utm_medium=email&utm_source=footer).

            For more options, visit [https://groups.google.com/a/continuum.io/d/optout](https://groups.google.com/a/continuum.io/d/optout).

  You received this message because you are subscribed to the Google

Groups “Bokeh Discussion - Public” group.

  To unsubscribe from this group and stop receiving emails from it,

send an email to [email protected].

  To post to this group, send email to [email protected].

  To view this discussion on the web visit [https://groups.google.com/a/continuum.io/d/msgid/bokeh/CAM9Ly3Hv6RE8JreDQuHzs%3DKT83nZfz6RgDHCd4RR9a%2BSOM36uQ%40mail.gmail.com](https://groups.google.com/a/continuum.io/d/msgid/bokeh/CAM9Ly3Hv6RE8JreDQuHzs%3DKT83nZfz6RgDHCd4RR9a%2BSOM36uQ%40mail.gmail.com?utm_medium=email&utm_source=footer).

  For more options, visit [https://groups.google.com/a/continuum.io/d/optout](https://groups.google.com/a/continuum.io/d/optout).

ws://localhost:5007/bokeh/sub/ws://localhost:5007/bokeh/sub/ws://localhost:5007/bokeh/sub/ws://localhostws://example.com

Hi there,

Did you get this working with nginx? I’m running into the same/similar problem. When I try and configure the proxy with nginx:

server {

listen 80 default_server;

listen [::]:80 default_server ipv6only=on;

listen 443 ssl;

ssl_certificate /####.crt;

ssl_certificate_key /####.key;

location /bokeh {

proxy_cache off;

proxy_pass http://localhost:5006;

}

location /static {

proxy_cache off;

proxy_pass http://localhost:5006;

}

}

I get a blank page with the following error log:

Mixed Content: The page at ‘#######’ was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint ‘ws://localhost:5006/bokeh/sub’. This request has been blocked; this endpoint must be available over WSS.WebSocketWrapper @ bokeh.js:61893

bokeh.js:14786 Bokeh: websocket creation failed for connection string: ws://localhost:5006/bokeh/subConsoleAppender.cerror @ bokeh.js:14786

bokeh.js:14786 Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS

I am very new to nginx as well, so there may be a super simple resolution I am missing.

···

On Tuesday, November 18, 2014 at 2:45:21 PM UTC, David Jung wrote:

Hi all.

So, I’m attempting to make bokeh-server accessible via an Nginx proxy. I’m running the server with the default options, so it listens on localhost:5006.

Then, in the nginx config, I have:

listen 443 default_server;

ssl on;

ssl_certificate /etc/nginx/ssl/server.crt;

ssl_certificate_key /etc/nginx/ssl/server.key;

    server_name  [example.com](http://example.com);
    location /bokeh {
   proxy_cache off;
   proxy_pass [http://localhost:5006](http://localhost:5006); 
   proxy_cookie_domain localhost [example.com](http://example.com);
   sub_filter '[http://localhost:5006](http://localhost:5006)' '[https://example.com](https://example.com)';
    }
    location /static {
       # .. same as above
    }

It works fine if I access it via http://example:5006. Now, when I access https://example.com/bokeh I see the following output in Chome’s Javascript console:

Bokeh: setting prefix to https://example.com/ bokeh.js:68001

Bokeh: setting ws_conn_string to: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

[blocked] The page at ‘https://example.com/bokeh/’ was loaded over HTTPS, but ran insecure content from ‘ws://localhost:5007/bokeh/sub/’: this content should also be loaded over HTTPS.

bokeh.js:68635

Bokeh: websocket creation failed for connection string: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS. bokeh.js:1723

Uncaught TypeError: Cannot set property ‘onopen’ of undefined bokeh.js:68642

So, I see a few issues with this setup: a) the JS is attempting to access ws://localhost instead of ws://example.com, and b) it isn’t using a secure connection, c) It is accessing port 5007.

This is my first time configuring nginx.

Does anyone familiar with nginx or with experience proxying bokeh-server have any pointers regarding configuring nginx or any bokeh-server options to achieve proxying?

Thanks!

-David

Hi Hugo,

Proxying bokeh-server through nginx shoud work fine. Have you tried specifying --ws-conn-string option on bokeh server to use wss instead of the default ws? Looks like this is your issue… So from your log you’d need to specify:

–ws-conn-string wss://prdbviewer:5006/bokeh/sub/

``

Also not that you may need to set the connection upgrade, so:

location /bokeh/sub {

proxy_pass http://localhost:5006;

proxy_http_version 1.1;

proxy_set_header Upgrade $http_upgrade;

proxy_set_header Connection “upgrade”;

}

Cheers

Fabio

···

On Thursday, May 14, 2015 at 5:36:20 PM UTC+2, Hugo Carr wrote:

Hi there,

Did you get this working with nginx? I’m running into the same/similar problem. When I try and configure the proxy with nginx:

server {

listen 80 default_server;

listen [::]:80 default_server ipv6only=on;

listen 443 ssl;

ssl_certificate /####.crt;

ssl_certificate_key /####.key;

location /bokeh {

proxy_cache off;

proxy_pass http://localhost:5006;

}

location /static {

proxy_cache off;

proxy_pass http://localhost:5006;

}

}

I get a blank page with the following error log:

Mixed Content: The page at ‘#######’ was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint ‘ws://localhost:5006/bokeh/sub’. This request has been blocked; this endpoint must be available over WSS.WebSocketWrapper @ bokeh.js:61893

bokeh.js:14786 Bokeh: websocket creation failed for connection string: ws://localhost:5006/bokeh/subConsoleAppender.cerror @ bokeh.js:14786

bokeh.js:14786 Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS

I am very new to nginx as well, so there may be a super simple resolution I am missing.

On Tuesday, November 18, 2014 at 2:45:21 PM UTC, David Jung wrote:

Hi all.

So, I’m attempting to make bokeh-server accessible via an Nginx proxy. I’m running the server with the default options, so it listens on localhost:5006.

Then, in the nginx config, I have:

listen 443 default_server;
ssl on;
ssl_certificate /etc/nginx/ssl/server.crt;
ssl_certificate_key /etc/nginx/ssl/server.key;
    server_name  [example.com](http://example.com);
    location /bokeh {
   proxy_cache off;
   proxy_pass [http://localhost:5006](http://localhost:5006); 
   proxy_cookie_domain localhost [example.com](http://example.com);
   sub_filter '[http://localhost:5006](http://localhost:5006)' '[https://example.com](https://example.com)';
    }
    location /static {
       # .. same as above
    }

It works fine if I access it via http://example:5006. Now, when I access https://example.com/bokeh I see the following output in Chome’s Javascript console:

Bokeh: setting prefix to https://example.com/ bokeh.js:68001

Bokeh: setting ws_conn_string to: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

[blocked] The page at ‘https://example.com/bokeh/’ was loaded over HTTPS, but ran insecure content from ‘ws://localhost:5007/bokeh/sub/’: this content should also be loaded over HTTPS.

bokeh.js:68635

Bokeh: websocket creation failed for connection string: ws://localhost:5007/bokeh/sub/ bokeh.js:1723

Bokeh: - SecurityError: Failed to construct ‘WebSocket’: An insecure WebSocket connection may not be initiated from a page loaded over HTTPS. bokeh.js:1723

Uncaught TypeError: Cannot set property ‘onopen’ of undefined bokeh.js:68642

So, I see a few issues with this setup: a) the JS is attempting to access ws://localhost instead of ws://example.com, and b) it isn’t using a secure connection, c) It is accessing port 5007.

This is my first time configuring nginx.

Does anyone familiar with nginx or with experience proxying bokeh-server have any pointers regarding configuring nginx or any bokeh-server options to achieve proxying?

Thanks!

-David