Summary of conversation with @Greg Stroup:

Summary

Take the server code from Security Starter's web server and turn into a Secure WS Relay repo that will enable the following:

1. UI connects securely to WS Relay through HTTPS using headers with tokens

2. WS Relay then opens a secure connection to the Target WS Endpoint

3. WS Relay responds to UI with socket ID of WS Relay - target endpoint connection

4. UI establishes WS connection (insecurely) to WS Relay with standard new WebSocket()

5. UI socket messages include socket ID

6. Upon receiving socket messages from UI, WS Relay only forwards messages with matching socket ID

Connection Security

• Insecure WS to WS Relay

• Secure WS Relay to Target WS Endpoint

Potential Enhancements

• Add additional security on REST WS Relay secure connection with PassportJS

Implementation Details

• Example: https://github.build.ge.com/AutomationNorth/hmi-microapp/blob/develop/server.js#L63

• UI connects to Server code who connects to service

• Service is now protected from DDOS attacks because UI server would fail first. This is preferable because service downtime could corrupt data integrity.

Reverse Proxy Requests and Handle WS Differently

 /**
  * Reverse proxy HTTP requests on the given endpoint. If proxyWs is true then it will also listen to upgrade requests on
  * that endpoint and proxy those too.
  * @param endpoint The endpoint where this reverse proxy should listen (ie. /my-reverse-proxy)
  * @param url The URL where these requests should be proxied to
  * @param proxyWs Whether this endpoint should also reverse proxy websocket connections
  */
 let doReverseProxy = (endpoint, url, proxyWs) => {
     console.log('Proxying requests to', endpoint, '->', url, proxyWs === true ? '(including websockets)' : '');
 
     let curProxy = reverseProxy.create(url, { ws: proxyWs === true });
 
     // proxy HTTP requests as express middleware
     app.use(endpoint, (req, res) => {
         curProxy.web(req, res);
     });
 
     curProxy.on('error', (err) => {
         console.warn('Error while proxying request to', url, err);
     });
 
     if (proxyWs === true) {
         // listen to upgrades and proxy them too if they come from the right place
         server.on('upgrade', (req, socket, head) => {
             if (req.url.startsWith(endpoint)) {
                 // since websocket requests aren't getting caught by the middleware their URL still has the reverse proxy endpoint
                 // on it. so we need to turn /my-reverse-proxy/some-url into /some-url for it to be reverse proxied correctly
                 req.originalUrl = req.url;
                 req.url = req.url.substring(endpoint.length);
                 curProxy.ws(req, socket, head);
             }
         });
         server.on('error', function (err, req, socket) {
             console.warn('Server error on socket', url, err);
             console.warn('arguments', arguments);
             socket.end();
         });
     }
 };

Pass Along Headers

 const httpProxy = require('http-proxy');
 const HttpsProxyAgent = require('https-proxy-agent');
 
 let options = {
     changeOrigin: true,
 };
 
 // if a proxy is set then use it in the connection
 let proxyServer = process.env.HTTPS_PROXY || process.env.HTTP_PROXY;
 if (proxyServer) {
     console.log('Configuring the reverse proxy to make its requests through the following HTTP proxy:', proxyServer);
     options.agent = new HttpsProxyAgent(proxyServer);
 }
 
 // if we're running locally look to the environment for token/tenant info
 options.headers = {};
 if (process.env.DEBUG_TOKEN) {
     options.headers.Authorization = 'Bearer ' + process.env.DEBUG_TOKEN;
 }
 
 if (process.env.TENANT_ID) {
     options.headers.tenant = process.env.TENANT_ID;
 }
 
 /**
  * Creates a reverse proxy on the given URL with the given options.
  * @param url The URL to proxy things to
  * @param otherOptions The options to use. These will supplement the default options at the top of this module.
  * @returns {*|Object} An http-proxy object
  */
 let createReverseProxy = (url, otherOptions) => {
     let myOptions = otherOptions || {};
 
     let properties = Object.getOwnPropertyNames(options);
     for (let i = 0; i < properties.length; i++) {
         let property = properties[i];
         if (!myOptions.hasOwnProperty(property)) {
             myOptions[property] = options[property];
         }
     }
     myOptions.target = url;
     return httpProxy.createProxyServer(myOptions);
 };
 
 module.exports = {
     create: createReverseProxy,
 };

References

• Predix Toolkit - Secure WS - API Explorer: https://predix-toolkit.run.asv-pr.ice.predix.io/#!/wsClient

  • Go to Client Login, then API Explorer to preview how this is set up

  • Underlying code for this example: https://github.com/PredixDev/security-starter

• Reference App: https://github.com/PredixDev/predix-rmd-ref-app

  • Uses Predix Websocket Server and Webapp Starter

• Webapp Starter: https://github.com/PredixDev/predix-webapp-starter

  • UI starter app that connects to Predix Websocket Server

• Predix Websocket Server: https://github.com/PredixDev/predix-websocket-server

  • Uses Predix Websocket Client

  • Note: Still unsure how to configure the Websocket Client through the Websocket Server

• Predix Websocket Client: https://github.com/PredixDev/predix-websocket-client