Changing from unsecure websocket (ws) to secure websocket (wss) in Spring Boot app

223 Views Asked by At

I am currently in the process of deploying an app with a spring boot backend and react frontend. Everything is up and running appropriately, except for the websockets. Everything worked in development when using http and ws. Everything is working properly over https except for the websocket connection because I'm unsure of how to configure the websocket to be secure. I've changed the url's for all the websocket addresses from ws to wss where needed on frontend.

This is my unchanged WebSocketConfig class. This was all I needed for it to work over http/ws:

@Configuration
@EnableWebSocketMessageBroker
public class WebSocketConfig implements WebSocketMessageBrokerConfigurer {

    @Override
    public void configureMessageBroker(MessageBrokerRegistry config) {
        config.enableSimpleBroker("/topic");
        config.setApplicationDestinationPrefixes("/app");
    }

    @Override
    public void registerStompEndpoints(StompEndpointRegistry registry) {
        registry.addEndpoint("/websocket")
                .setAllowedOriginPatterns("*");
    }

}

I have found and tried to use this class from the Spring docs which claims to disable csrf on a secure websocket, but it just results in an error where "this.context cannot be resolved".

@Configuration
public class WebSocketSecurityConfig implements WebSocketMessageBrokerConfigurer {

    @Override
    public void addArgumentResolvers(List<HandlerMethodArgumentResolver> argumentResolvers) {
        argumentResolvers.add(new AuthenticationPrincipalArgumentResolver());
    }

    @Override
    public void configureClientInboundChannel(ChannelRegistration registration) {
        AuthorizationManager<Message<?>> myAuthorizationRules = AuthenticatedAuthorizationManager.authenticated();
        AuthorizationChannelInterceptor authz = new AuthorizationChannelInterceptor(myAuthorizationRules);
        AuthorizationEventPublisher publisher = new SpringAuthorizationEventPublisher(this.context);
        authz.setAuthorizationEventPublisher(publisher);
        registration.interceptors(new SecurityContextChannelInterceptor(), authz);
    }
}

I want to enable secure websocket over wss but I want to disable csrf and permit all destinations, if possible. Once i get it connected, I will concern myself with making it secure.

I just want my https frontend to be able to connect to wss://my-server-url/websocket as easily as possible. Server also has valid ssl cert and is serving through https. Thanks.

0

There are 0 best solutions below