SignalR (WebSocket) with CloudFlare Access return "WebSocket failed to connect"

Zero Trust Access
1

I have local web app that connects to SignalR using webSocket at wss://mysubdomain/messages on my remote server.
Access to the server is carried out using a zero trust tunnel with public hostname https://mysubdomain.
If that URL doesn’t have an “access → application” policy configured, I can connect to SignalR webSocket.
But when access policy in configured, webApp catch the error “Error: Failed to start the connection: Error: WebSocket failed to connect. The connection could not be found on the server, either the endpoint may not be a SignalR endpoint, the connection ID is not present on the server, or there is a proxy blocking WebSockets. If you have multiple servers check that sticky sessions are enabled.”
Access config has 2 allow policies:

  1. All users that login Azure Add;
  2. Service Token. (used by webApp to API request );
    and in “settings” has allow all origins, methods and headers.
    With this access policy, the web application can successfully request the API, but an attempt to connect to the webSocket returns an error.
    How to configure access policy to work with signalR gj to websocket?
3

What is the response being returned by Cloudflare? It is possible the WebSocket upgrade request is not presenting the required credentials.

4

Thank you for the quick response.
In client option “skipNegotiation” set on “true”. i.e. client skips negotiation when connecting to server.
In console i get:
“WebSocket connection to ‘wss://mysubdomain/messagehub/messages’ failed:”
“Error: Failed to start the connection: Error: WebSocket failed to connect. The connection could not be found on the server, either the endpoint may not be a SignalR endpoint, the connection ID is not present on the server, or there is a proxy blocking WebSockets. If you have multiple servers check that sticky sessions are enabled.”

5

The client did not receive a response from Cloudflare when trying to connect to the web socket.

6

Any solutions to this? I already have WebSockets enabled on my dashboard, still getting a lot of errors, signalr cant connect

7

Alright so I found a solution to my problem, emphasis on my because I’m not sure if this is going to work for everyone else, turns out it was NGINX blocking some headers and that the Connection header needs to be “upgrade”. I had to go to the NGINX configuration file and add this block inside a server block

location /hubs/students/chat {
    proxy_pass http://127.0.0.1:5000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
}