Under tornado v4+ WebSocket connections get refused with 403

Tornado 4.0 introduced an, on by default, same origin check. This checks that the origin header set by the browser is the same as the host header

The code looks like:

 def check_origin(self, origin):    """Override to enable support for allowing alternate origins.    The ``origin`` argument is the value of the ``Origin`` HTTP header,    the url responsible for initiating this request.    .. versionadded:: 4.0    """    parsed_origin = urlparse(origin)    origin = parsed_origin.netloc    origin = origin.lower()    host = self.request.headers.get("Host")    # Check to see that origin matches host directly, including ports    return origin == host

In order for your proxied websocket connection to still work you will need to override check origin on the WebSocketHandler and whitelist the domains that you care about. Something like this.

import refrom tornado import websocketclass YouConnection(websocket.WebSocketHandler):    def check_origin(self, origin):        return bool(re.match(r'^.*?\.mydomain\.com', origin))

This will let the connections coming through from info.mydomain.com to get through as before.

I would like to propose and alternative solution, instead of messing with the tornado application code, I solved the issue by telling nginx to fix the host header:

location /ws {proxy_set_header Host $host;proxy_pass http://backend;proxy_http_version 1.1;proxy_set_header Upgrade $http_upgrade;proxy_set_header Connection "upgrade";}