From 5f3d9ed96f05b25b3c7f38df550d9f2bce0ec199 Mon Sep 17 00:00:00 2001 From: Chris Meyers Date: Tue, 13 Feb 2024 13:12:05 -0500 Subject: [PATCH] More locked down websocket path * Previously, the nginx location would match on /foo/websocket... or /foo/api/websocket... Now, we require these two paths to start at the root i.e. /websocket/... /api/websocket/... * Note: We now also require an ending / and do NOT support /websocket_foobar but DO support /websocket/foobar. This was always the intended behavior. We want to keep /api/websocket/... "open" and routing to daphne in case we want to add more websocket urls in the future. --- roles/installer/templates/configmaps/config.yaml.j2 | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/roles/installer/templates/configmaps/config.yaml.j2 b/roles/installer/templates/configmaps/config.yaml.j2 index 84479d26..b2003c3d 100644 --- a/roles/installer/templates/configmaps/config.yaml.j2 +++ b/roles/installer/templates/configmaps/config.yaml.j2 @@ -188,7 +188,7 @@ data: alias /var/lib/awx/public/static/media/favicon.ico; } - location ~ ({{ (ingress_path + '/websocket').replace('//', '/') }}|{{ (ingress_path + '/api/websocket').replace('//', '/') }}) { + location ~ ^({{ (ingress_path + '/websocket/').replace('//', '/') }}|{{ (ingress_path + '/api/websocket/').replace('//', '/') }}) { # Pass request to the upstream alias proxy_pass http://daphne; # Require http version 1.1 to allow for upgrade requests