search

erebe / wstunnel

Tunnel all your traffic over Websocket or HTTP2 - Bypass firewalls/DPI - Static binary available
Other
3.22k stars 290 forks source link

Use another channel to send bearer tokens #198

Closed BastienFaure closed 4 months ago

BastienFaure commented 4 months ago

Howdy,

First let me tell you that I like this tool, it is fast, has great debug, and for now is not flagged anywhere :smile:

However, I am facing a situation where I am unable to establish the websocket connection due to a reverse-proxy that tampers with the websocket upgrade request.

After troubleshooting a bit, I found out that the proxy was stripping query params from the upgrade request, which obviously prevented the wstunnel session from successfully mounting. I assumed this was a behavior specific to the revers-proxy I was dealing with until I tried to setup a wstunnel server behind a Cloudfront distribution, and the same happened: query params stripped on the incoming request.

I guess a good workaround would be to give a bit flexibility to the user about how he wants the bearer token to be sent. The following options are not exhaustive but I can't think about any other at the moment:

Happy to chat about it if needed.

erebe commented 4 months ago

Hello :)

That's seem odd to me because query params is kind of the only way to pass information with the websocet javascript API from browser. https://stackoverflow.com/questions/4361173/http-headers-in-websockets-client-api https://stackoverflow.com/a/77060459

Would you mind sharing the log of wstunnel client and server with the env variable RUST_LOG=trace set ? So I can take a look at what the server receive.

If you are right, I can try to pass the info in the Sec-WebSocket-Protocol header

erebe commented 4 months ago

Would you mind trying release v8.5.0 and let me know if it works better for you ? https://github.com/erebe/wstunnel/releases/tag/v8.5.0

I now pass tunnel info into Sec-WebSocket-Protocol header

erebe commented 4 months ago

feel free to re-open if needed

BastienFaure commented 4 months ago

@erebe I have done a little bit more digging and I am pretty sure it was just me that did not configure the cloudfront distribution properly (it does not forward query parameters by default).

So I guess whether you send it through a header or a query param should not make a difference.

Apologies for the overrun :smile:

erebe commented 4 months ago

Hey no worries, and thanks for letting me know :)

In the end, I think passing the tunnel info inside the weboscket header protocol is more future-proof, as it is part of the spec ^^

Enjoy :)