Django WebSocket Deployment with HTTPS

Based on the information you've provided about your WebSocket connection issues in production, here are some insights regarding SSL/HTTPS configuration that might help resolve your problem:

SSL Configuration Considerations

When deploying a Django application with WebSockets behind a load balancer that handles SSL termination, there are several important security settings to consider:

SSL Proxy Headers

If your load balancer terminates SSL and forwards requests to nginx as HTTP, you need to properly configure the SSL proxy headers:

PYTHONCopied
# In your Django settings.py
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')

This setting is crucial when your application is behind a proxy that handles SSL. Failure to configure this correctly can result in CSRF vulnerabilities.

WebSocket Proxy Configuration

For nginx to properly proxy WebSocket connections, you need specific configuration:

NGINXCopied
location /ws/ {
    proxy_pass http://localhost:5000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Addressing Your Specific Questions

1. Does nginx need an SSL certificate if the load balancer handles SSL?

   No, nginx doesn't need its own SSL certificate if your load balancer is properly terminating SSL. However, you need to ensure that nginx is correctly configured to understand it's receiving traffic that was originally HTTPS. This is typically done by having the load balancer pass appropriate headers (like X-Forwarded-Proto) and configuring nginx to trust these headers.

2. Could there be an issue with consumer configuration?

   The 404 error suggests that your ASGI application isn't recognizing the WebSocket path. This could be due to:

   • Routing configuration issues in your ASGI application
   • Differences in URL path resolution between development and production
   • Potential issues with how the WebSocket URL is constructed in the client (especially if it's using relative paths)

Additional Security Recommendations

For a secure deployment, consider these additional settings:

PYTHONCopied
# Redirect HTTP to HTTPS
SECURE_SSL_REDIRECT = True

# Use secure cookies
SESSION_COOKIE_SECURE = True
CSRF_COOKIE_SECURE = True

# Implement HSTS
SECURE_HSTS_SECONDS = 31536000  # 1 year
SECURE_HSTS_INCLUDE_SUBDOMAINS = True
SECURE_HSTS_PRELOAD = True

Make sure your ALLOWED_HOSTS setting is properly configured for your production domain to prevent CSRF attacks.

For WebSocket debugging, I recommend checking both server logs and browser console for more detailed error messages that might help pinpoint the exact issue.