Websocket reverse proxy on cloudflare

[mdui]

Does anyone know how to deal with it?

I set up the website iofod.com on cloudflare and my SSL/TLS encryption mode is Flexible.

However, I can’t request the websocket services through ws://socket.iofod.com, but must be through
wss://socket.iofod.com, yes I can implement reverse proxy through nginx forwarding, but I want to do it through the configuration on cloudflare, what should I do ?

[sandro]

@mdui

Flexible

That’s insecure to begin with and you should set this to Full Strict.

Why you should choose Full Strict, and only Full Strict

Unencrypted & unverified connections Imagine you open Paypal and suddenly get that warning [image] Would you continue? Probably not. For decades leaders in IT security have advocated that people upgrade their sites from unencrypted HTTP to secure HTTPS. And for a reason, everything you send via an HTTP connection is sent in plain text and can be intercepted at any point between you and the server. Equally, you’d probably not proceed if you got such a warning, right? [image] That’s when th…

[mdui]

Thanks, you are correct. Full Strict eliminates potential security risks. I’ve used render’s hosting service before and found that they can do what I described, they also use cloudflare, I guess they probably do websocket reverse proxy by some magic configuration of cloudflare.

[sandro]

In that case I’d suggest you secure the encryption mode at this point.

As for the WebSocket question, socket.iofod.com does not exist but apart from that you might also want to check out HTTPS redirects and HSTS. Especially if the latter is enabled, you probably won’t be able to use ws:.