HA代理和Websockets

我正在build立我的第一个HAProxy反向代理服务器。 这将是一个在不同服务器上运行在tomcat上的HTML5应用程序的代理。 我能够通过HTTP代理它，将所有请求redirect到HTTPS，并实现HSTS。 但是，这样做后，我意识到，它也试图加载websocket连接。 问题是它加载的websocket连接是不安全的（ws：//）并且不安全（wss：//）。 当然，Chrome（大概是多个浏览器）抱怨通过安全连接加载不安全的脚本。 这是我得到的错误：

Connecting via WebSocket using url ws://website.domain.com:9091/webclient/ Mixed Content: The page at 'https://website.domain.com/webclient/' was loaded over HTTPS, but attempted to connect to the insecure WebSocket endpoint 'ws://website.domain.com:9091/webclient/'. This request has been blocked; this endpoint must be available over WSS. Caught WebSocket error: SecurityError: Failed to construct 'WebSocket': An insecure WebSocket connection may not be initiated from a page loaded over HTTPS. 

所有这些都通过/webclient/script/ajaxclient.js:210加载

由于这是第三方应用程序，我不确定是否可以让他们更改他们的应用程序。 因此，我想知道是否有什么我可以在HAProxy服务器上强制安全的websocket连接。 有什么想法吗？

这里是我的HAProxy conf文件供参考：

• haproxy sendmsglogging器＃1失败：没有这样的文件或目录
• 重新启动HAProxy而不会丢失计数器
• HAPROXY后面的mod_evasive
• haproxy：有没有办法将acls分组以提高效率？
• 重新启动Haproxy优雅

 global log 127.0.0.1 local2 chroot /var/lib/haproxy pidfile /var/run/haproxy.pid maxconn 1000 user haproxy group haproxy daemon # turn on stats unix socket stats socket /var/lib/haproxy/stats # Default SSL cert locations ca-base /etc/haproxy/ssl_2015 crt-base /etc/haproxy/ssl_2015 # Default ssl ciphers ssl-default-bind-ciphers ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4 # max size of temp DHE keys that are generated tune.ssl.default-dh-param 4096 defaults mode http log global option httplog option dontlognull option http-server-close option forwardfor except 127.0.0.0/8 option redispatch option http-server-close retries 3 timeout http-request 10s timeout queue 1m timeout connect 10s timeout client 1m timeout server 1m timeout http-keep-alive 10s timeout check 10s timeout tunnel 4hrs # long timeout for Websocket connections maxconn 3000 #--------------------------------------------------------------------- # http frontend #--------------------------------------------------------------------- frontend http_https_frontend bind 192.168.2.201:80 redirect scheme https if !{ ssl_fc } bind 192.168.2.201:443 ssl crt /etc/haproxy/ssl_2015/ssl_crt.pem acl secure dst_port eq 443 rspadd Strict-Transport-Security:\ max-age=16000000;\ includeSubDomains;\ preload; rsprep ^Set-Cookie:\ (.*) Set-Cookie:\ \1;\ Secure if secure # # routing based on websocket protocol header # acl is_websocket hdr(Upgrade) -i WebSocket acl is_websocket hdr_beg(Host) -i ws use_backend ws_backend if is_websocket # # 16000000 seconds: a bit more than 6 months # http-response set-header Strict-Transport-Security max-age=16000000;\ includeSubDomains;\ preload; default_backend https_backend #--------------------------------------------------------------------- # http backend #--------------------------------------------------------------------- backend https_backend reqadd X-Forwarded-Proto:\ https server websvr1_http 192.168.1.125:8080 #--------------------------------------------------------------------- # ws backend #--------------------------------------------------------------------- backend ws_backend server websvr1_ws 192.168.1.125:9091 

HAProxy服务器是运行HAProxy 1.5.4的CentOS 7.1.1503服务器。

提前致谢！