P0 hosted: WebSocket transport must traverse a reverse proxy on the standard HTTPS port #72

New issue

Open

opened 2026-09-06 18:32:04 +00:00 by nsaspy · 0 comments

nsaspy commented

2026-09-06 18:32:04 +00:00

Owner

Problem

frontend/src/control-plane/client.ts#defaultWebSocketUrl hardcodes port 8081: \`${scheme}://``${window.location.hostname}:8081?session=...`. A hosted deployment behind the shared web origin (Cloudflare -> ord-edge -> mallcop -> web Caddy on 443, quasar.starintel.actor) cannot expose a second public port, so the browser can never reach the control-plane WebSocket: the hosted UI is permanently standalone.

The websocket server also binds 127.0.0.1:8081 by default; behind the origin's reverse proxy it needs a path-mapped same-origin route.

Required

Client: derive the WS endpoint from configuration injected by the host (e.g. a quasar-control-ws meta tag emitted alongside the existing quasar-session-token), falling back to today's behavior for local/desktop use.
Server/host: document and support serving the WS endpoint at a same-origin path (e.g. /control-ws) through the reverse proxy while CLOG keeps serving the SPA.
WebSockets must survive the full proxy chain (Cloudflare, mallcop, web Caddy) — connection upgrade headers preserved.

Acceptance

A hosted deployment serves SPA + control-plane WS on one origin/port; the UI connects and synchronizes instead of degrading.
Local desktop/dev behavior unchanged.

## Problem `frontend/src/control-plane/client.ts#defaultWebSocketUrl` hardcodes port 8081: `\`\`${scheme}://\`\`\${window.location.hostname}:8081?session=...`. A hosted deployment behind the shared web origin (Cloudflare -> ord-edge -> mallcop -> web Caddy on 443, quasar.starintel.actor) cannot expose a second public port, so the browser can never reach the control-plane WebSocket: the hosted UI is permanently standalone. The websocket server also binds 127.0.0.1:8081 by default; behind the origin's reverse proxy it needs a path-mapped same-origin route. ## Required - Client: derive the WS endpoint from configuration injected by the host (e.g. a `quasar-control-ws` meta tag emitted alongside the existing `quasar-session-token`), falling back to today's behavior for local/desktop use. - Server/host: document and support serving the WS endpoint at a same-origin path (e.g. `/control-ws`) through the reverse proxy while CLOG keeps serving the SPA. - WebSockets must survive the full proxy chain (Cloudflare, mallcop, web Caddy) — connection upgrade headers preserved. ## Acceptance - A hosted deployment serves SPA + control-plane WS on one origin/port; the UI connects and synchronizes instead of degrading. - Local desktop/dev behavior unchanged.

nsaspy referenced this issue from starintel-labs/starintel-biz

2026-09-06 19:08:26 +00:00

Track interim Quasar hosted authentication plugin #7