Implementing https and socket io

Question

I have been searching high an low for this and have not been able to find a solution. I have the following code in the server:

import express from 'express'; import { createServer } from 'https'; import { Server } from "socket.io"; import fs from 'fs'; const app = express(); const credentials = { key: fs.readFileSync('../key.pem'), cert: fs.readFileSync('../cert.pem') }; // create http/https server const server = createServer(credentials, app); const io = new Server(server); io.on('connection', (socket) => { console.log('a user connected'); }); server.listen(3000, () => { console.log('listening on localhost:3000'); });

Now in the client side I have:

import { io } from "socket.io-client"; import fs from "fs"; const socket = io("https://localhost:3000", { rejectUnauthorized: false, ca: fs.readFileSync("../cert.pem") }); socket.on("connect", () => console.log("connected to server"));

If I change the server side to import to:

import { createServer } from 'http';

instead of:

import { createServer } from 'https';

and I change the client side to:

const socket = io("http://localhost:3000");

instead of:

const socket = io("https://localhost:3000");

I socket io is able to communicate just fine

It is just the https. I tried to add certs and to set

rejectUnauthorized: false

with no avail. I found this question, but nothing there has worked. The socket io documentation has not been much help. What can I try next?

You should enable debug log in order to get an explanation on the why SSL it's not working. — Pilpo
– Pilpo, Commented Oct 15, 2021 at 7:55

BGPHiJACK · Accepted Answer · 2021-10-15 08:08:42Z

1

As HTTPS will try to reject at 127.0.0.1, WSS will as well but off the bat no way to bypass correct?

In development most users hit this wall initially till they have more time to set this up correctly.

Insert this code into your web socket server file.

process.env["NODE_TLS_REJECT_UNAUTHORIZED"] = 0;

Only in development do you use this, it's not to EVER be used in production.

answered Oct 15, 2021 at 8:08

BGPHiJACK

1,4071 gold badge11 silver badges19 bronze badges

Sign up to request clarification or add additional context in comments.

14 Comments

user5734311 Over a year ago

Please check for duplicates before posting an answer

Salty Salamander Over a year ago

I know, I did but non of the other questions solved my problem.

BGPHiJACK Over a year ago

Generally just an issue with bypassing secure features; your certs provided as well may not be suitable for local-development, I've seen this a few times thus not allowing secure connection at all even if bypassed. So in other words if you didn't produce those certs ditch them rewrite new ones for testing and get busy. :)

Salty Salamander Over a year ago

@blanknamefornow, Thank you for the answer. Although it still doesn't work. Do you think it has something to do with the self-signed certificate? would it work with an an other type of certificate?

Salty Salamander Over a year ago

Yeah, I have produced generated the certs twice already.

|

bato3 · Accepted Answer · 2021-10-15 09:12:47Z

The best option to implement https in your application is to do it on a "real" http server. E.g.: nginx, Apache, ...

What you get directly from Node is sufficient for development purposes, but it is not recommended using it in a real environment. If only because it handles Keep-Alive connections on average. (This is what you'll experience the fastest.)

Next come the issues of performance and scalability. You must remember that the Node application is basically single-threaded. With many customers, even the "stupid" cors request takes resources that could be spent on actual customer service.

Did you know you can run multiple instances of a Node application? (it is enough to properly manage the shared data) This can be done e.g. via upstream in nginx. Or use e.g. Phusion Passenger (Which will immediately manage application restarts after an unexpected crash, instead of managers like pm2)

Thanks @Bato3, this are amazing tips. I definitely use them when deploying in the server. !
And yeah,I kind of gave up trying to get HTTPS working in development. I had the notion that this was a issue I might have to solve now better than later, but now I realize that it might be easier to actually solve it later. Thank you for input.

Collectives™ on Stack Overflow

Implementing https and socket io

2 Answers 2

14 Comments

2 Comments

Linked

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

14 Comments

2 Comments

Linked

Related