ExternalContextImpl.encodeWebsocketURL fails behind SSL termination

[schulzp]

Hi

I'm using <f:websocket> and do get JS error:

jsf.js:1 Mixed Content: The page at 'https://...' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://.../javax.faces.push/events?ea1d8743-eca9-45a0-b548-ad3b1fd48c69'. This request has been blocked; this endpoint must be available over WSS.

ExternalContextImpl uses request.getSchema() to determine the correct protocol, yet that does not work behind a reverse proxy terminating SSL (HTTPS) and forwarding the request via HTTP.

Instead, it should use HttpServletRequest#getRequestURL().

[schulzp]

Hi @arjantijms!

With all due respect, is there any chance this fix is going to make it into the next release?

[arjantijms]

Hi,

Somewhat catching up on a huge backlog of emails. From a glance this would be in scope indeed, although the code in question is Bauke's area of expertise. I'll provisionally assign this to him.

Thanks for the report!

[schulzp]

Hi!

Thanks, @arjantijms. @BalusC, could you please have a look?

Cheers
Peter

[BalusC]

Instead, it should use HttpServletRequest#getRequestURL().

This fix is correct. Can you create PR?

[schulzp]

@BalusC, here you are: #4529 😄

[schulzp]

Thanks, @arjantijms and @BalusC!

[michael-knapp-j4care]

I have the same error message on a client site, the setup described below is used:
Browser connects via TLS to some secure proxy, the proxy itself connects via unsecure http to the application server. The application server is not aware of that secure communication in the browser and generates there unsecure ws:// URL, which is rendered to the HTML output.
Solution: it should be decided on client side (in jsf.js) when to use ws:// or wss://