Websockets over HTTPS 403 Forbidden

Question

I'm currently trying to configure HTTPS in my spring boot 1.2 application. This application uses many web interfaces for communication between two servers. When it works on simple HTTP, everything works fine, but when I switch it to HTTPS, I get a 403 Forbidden error in both Firefox and Chrome (I haven’t tested it on IE.) I have a SimpleCORSFilter setting that accepts all connections , so I do not think that this is a problem. All RESTful requests via HTTPS for the operation of the same server, its just websockets, which seem to be blocked.
Here is my WebSocket spring configuration

@Configuration @EnableWebSocketMessageBroker public class WebSocketConfig extends AbstractWebSocketMessageBrokerConfigurer { @Override public void configureMessageBroker(MessageBrokerRegistry config) { config.enableSimpleBroker("/topic"); config.setApplicationDestinationPrefixes("/app"); } @Override public void registerStompEndpoints(StompEndpointRegistry registry) { registry.addEndpoint("/simulation").withSockJS(); } } 

Here is my front panel web connection

  socket = new SockJS(https://my.url + '/simulation'); stompClient = Stomp.over(socket); stompClient.debug = false; stompClient.connect({}, function(frame) { stompClient.subscribe('/topic/', function(status){ // Do something with result }); }); 

EDIT: this is a bug in the Chrome console

 GET https://localhost:8090/simulation/info 403 (Forbidden) stomp.js:8 Whoops! Lost connection to undefined 

EDIT 2: This error seems to be a side effect of the recent upgrade from spring download 1.1 to spring download 1.2. I will update when I indicate which of the dependencies is causing the error.

Answer 1

Try the following:

 @Override public void registerStompEndpoints(StompEndpointRegistry registry) { registry.addEndpoint("/simulation").setAllowedOrigins("*").withSockJS(); } 

Keep in mind that source resolution for all sources can impose a cross-site Forgery query. See https://www.owasp.org/index.php/Cross-Site_Request_Forgery_(CSRF) for ways to protect against it.