Open-IM-Server | IM instant messaging | Websocket library

Doctrine uses the identity map

The websocket server is a daemon and all cleanup tasks are the responsibility of the developer

Use

\Doctrine\ORM\EntityManager::find with the $lockMode argument = \Doctrine\DBAL\LockMode::NONE

OR

Call the \Doctrine\ORM\EntityManager::clean method before \Doctrine\ORM\EntityManager::find

Browsers do not support headers for websockets, therefore the bearer token has to be added as query string parameter. We hit the maximum length for URLs due to the length of our bearer token. We could shorten our token or use a reference token, see also: https://github.com/aspnet/SignalR/issues/1266

Hope this helps others as well.

Here is the solution described again, maybe a little bit more convenient:

To fix this problem, I changed in the site-configuration (/etc/nginx/sites-available) of nginx the following variables:

There is no problem with your websocket route. Could you please share how you are triggering this route? Websocket is a different protocol and I'm suspecting that you are using a HTTP client to test websocket. For example in Postman:

Postman New Screen

HTTP requests are different than websocket requests. So, you should use appropriate client to test websocket.

The enableCors and { cors: true } options are for the HTTP server (express or fastify). The URL given showing the CORS error came from a socket.io connection. To enable CORS for socket.io you need to use the options in the @WebsocketGateway() decorator, like

Keep it easy.
Certs inside your application are complex - they are hard to manage and you will get problems to run your application in a modern cloud environment (start new environments, renew certs, scale your application, ...).

Simple conclusion: Dont implement any certs.

As Mike already pointed out in the comments: WebSockets are just upgraded HTTP(S) connections. A normal webserver (nginx, apache) takes care about the certs. It can be done in kubernetes (as ingress-controller) or with a "bare-metal" webserver.
Both of them should act as a reverse-proxy. This means: Your java-application doesn't know anything about certs. It has just unencrypted connections - like in your code on port 6868.
But the client will not use this port. 6868 is only internally reachable.

The client will call your reverse-proxy at the normal HTTPS port (=443). The reverse-proxy will forward the connection to your java-application.

Here some links for further information:

• nginx reverse-proxy
• nginx reverse-proxy for websocket
• tutorial for java behind reverse-proxy
• LetsEncrypt for automatic and free certs

Is there a way to push my local Websocket to a live environment?

It's not straightforward because you need more than vanilla webrtc (which is peer-to-peer). What you want is an SFU. Take a look at mediasoup.

To realize why this is needed think about how the webrtc connection is established in your current app. It's a negotiation between two parties (facilitated by a signaling server). In order to turn this into a multi-cast setup you will need a proxy of sorts that then establishes separate peer-to-peer connections to all senders and receivers.

The question/bounty/op is specifically asking for a reputable source. Instead of rolling a custom solution, my proposal is that a known proven library should be used - that has been used, audited, forked, and in general used by the community and that is hosted on github.

The second option is to roll your own (though not recommended) and there are many exccelent answers on how to do it involving the addEventListener

Wshook is a library (hosted on github) that allows to easily intercept and modify WebSocket requests and message events. It has been starred and forked multiple times.

Disclaimer: I don't have any relationship with the specific project.strong text

Example:

When Apache is proxying websockets, there is 1 TCP connection between the client and Apache and 1 TCP connection between Apache and the backend.

Apache watches both connections for activity and forwards read from one onto the other.

This is the only way it can be in a layer 7 (Application Layer, HTTP) proxy. Something tunnelling at a much lower layer, like a NAT device or MAC forwarding IP sprayer could tunnel a single connection -- but not on the basis of anything higher up in the stack like headers.

The 2nd connection is observable with netstat.

The 2nd connection is opened when mod_proxy_wstunnel calls ap_proxy_connect_to_backend() which calls apr_socket_create() which calls the portable socket() routine. When recent releases of mod_proxy_http handle this tunneling automatically, simialr flow through ap_proxy_acquire_connection.