Can I have sticky sessions with HAProxy and socket.io with authentication?

Question

I have multiple instances of socket.io with authentication running under HAProxy, and I need to force the authentication request and socket connection to go to the same instance. I configured HAProxy based on this answer to the SO question with some changes:

global maxconn 4096 # Total Max Connections. This is dependent on ulimit nbproc 2 defaults mode http frontend all 0.0.0.0:80 timeout client 86400000 default_backend www_backend acl is_websocket hdr(Upgrade) -i WebSocket acl is_websocket hdr_beg(Host) -i ws use_backend socket_backend if is_websocket backend www_backend balance url_param sessionId option forwardfor # This sets X-Forwarded-For timeout server 30000 timeout connect 4000 server server1 localhost:8081 weight 1 maxconn 1024 check server server2 localhost:8082 weight 1 maxconn 1024 check server server3 localhost:8083 weight 1 maxconn 1024 check backend socket_backend balance url_param sessionId option forwardfor # This sets X-Forwarded-For timeout queue 5000 timeout server 86400000 timeout connect 86400000 server server1 localhost:8081 weight 1 maxconn 1024 check server server2 localhost:8082 weight 1 maxconn 1024 check server server3 localhost:8083 weight 1 maxconn 1024 check 

I tried url_param (where sessionId is the querystring parameter passed both during the authentication call and in connection with the web server) and the source as balance parameters, but it seems that HAProxy allows these options for HTTP connections and therefore ignores them for the actual network connection. As a result, sometimes auth request and socket connection end on different servers, which is unacceptable for our application.

Is there any way to get this desired behavior?

Answer 1

I use cookie-based balancing this way:

 backend socketio mode http cookie SIO insert server sock1 127.0.0.1:8001 cookie 001 server sock2 127.0.0.1:8002 cookie 002 

Answer 2

To balance the TCP connection, you can have some success in the stickiness table with the stick_match or stick on commands and explicitly set the tcp mode.

Here is an example:

 # forward SMTP users to the same server they just used for POP in the # last 30 minutes backend pop mode tcp balance roundrobin stick store-request src stick-table type ip size 200k expire 30m server s1 192.168.1.1:110 server s2 192.168.1.1:110 backend smtp mode tcp balance roundrobin stick match src table pop server s1 192.168.1.1:25 server s2 192.168.1.1:25 

Full documentation is available here .

Answer 3

To balance network connections with roundrobin . Since its bidirectional socket binding (over TCP) is supported by default. For other transports using source a balancing algorithm is the best choice. (You can use cookie-based persistence, but socket.io does not send JSESSIONID or the like back to the proxy. You can try sockjs if you want cookie-based persistence.)

Example:

 #do the same for other transports. [Note in 0.6.x resource was mounted at path: /socket.io/[transport] acl is_JSONPolling path_beg /socket.io/1/jsonp-polling use_backend non_websocket if is_JSONPolling backend non_websocket balance source #rest same as the one for websocket backend 

Answer 4

You are using HTTP, so insert a cookie for persistence - this is definitely the best route. This will be tied to the first server they went to if it doesn't go down.

You can also configure whether to rewrite it if it is omitted, etc.