ssl handshake failed when using unencrypted websocket connection about pusher-fake-example

[tristandunn]

Have you tried connecting to it from a regular page instead of from the Chrome extension? That's the one thing standing out to me from looking over the details here. If it works there but not in the extension then I'm not quite sure what's up.

[edwardotis]

Hi Tristan,

I finally got to the bottom of it.
TL;DR

pusher-fake-example works fine. No bug in it.

Long Explanation:
My setup on localhost for dev:

• gunicorn/Django server that hosts main website and also the /pusher/auth endpoint.
• pusher-fake-example rails server hosting websocket server on port 50389
• chrome extension client running pusher-js.js and communicating to the django and the pusher-fake servers.

By using chrome://net-internals, I was able to see that Chrome was talking to the gunicorn/django python process instead of the pusher-fake ruby on rails process when it opened a websocket to "ws://localhost:50389"

I had HSTS (http-strict-transport-security) enabled on my django server, and that automatically routed the request to wss, which was not enabled on any of my dev servers. And this resulted in the chrome_debug.log showing: ERROR:ssl_client_socket_openssl.cc(1149)] handshake failed; returned -1, SSL error code 1.

So, there appears to be a bug in Chrome where the browser's first websocket request targeted for port 50389 on localhost is being incorrectly sent to the process running on localhost at port 8000. Maybe Chrome is caching the port and/or host from a previous http request, instead of correctly using the host and port passed into window.WebSocket()

Anyway, I just disabled HSTS on my dev environments, and that works around the issue.

Best,

Ed

Netstat:
tcp 0 0 127.0.0.1:50389 0.0.0.0:* LISTEN 38359/rails
tcp 0 0 127.0.0.1:39381 0.0.0.0:* LISTEN 38359/rails
....
tcp 0 0 127.0.0.1:8000 0.0.0.0:* LISTEN 41759/python3.5

Logs example:

{
params: {
load_flags: 18,
method: "GET",
priority: "LOWEST",
url: "ws://localhost:50389/app/?protocol=7&client=js&version=3.0.0&flash=false"
},
phase: 1,
source: {
id: 28829,
type: 1
},
time: "30665109",
type: 94
},
{
params: {
reason: "HSTS"
},
phase: 0,
source: {
id: 28829,
type: 1
},
time: "30665109",
type: 101
},
{
params: {
headers: [
"HTTP/1.1 307 Internal Redirect",
"Location: wss://localhost:50389/app/?protocol=7&client=js&version=3.0.0&flash=false",
"Non-Authoritative-Reason: HSTS",
"Access-Control-Allow-Origin: chrome-extension://",
"Access-Control-Allow-Credentials: true"
]
},
phase: 0,
source: {
id: 28829,
type: 1
},
time: "30665109",
type: 102
},
{
phase: 1,
source: {
id: 28829,
type: 1
},
time: "30665110",
type: 96
},
{
phase: 2,
source: {
id: 28829,
type: 1
},
time: "30665110",
type: 96
},
{
params: {
location: "wss://localhost:50389/app/?protocol=7&client=js&version=3.0.0&flash=false"
},
phase: 0,
source: {
id: 28829,
type: 1
},
time: "30665110",
type: 95
},

...

{
params: {
error_lib: 33,
error_reason: 100,
file: "../../net/socket/ssl_client_socket_openssl.cc",
line: 2032,
net_error: -100,
ssl_error: 1
},