400 Bad Request with: Socketio & Python under SSL & Uvicorn

[Merlin673]

Hi Miguel,

I am trying to get https working with uvicorn and socketio + python.

Firstly, when I start uvicorn in http mode everything works fine for localhost:8000/ with: uvicorn async_app:app

The problem happens when I switch to ssl:

I am using a self signed cert for localhost from my local CA, on my localhost.

Now with https, I start uvicorn with: uvicorn async_app:app --ssl-keyfile ../../localhost/localhost.key.pem --ssl-certfile ../../localhost/localhost.cert.pem --port 5000

The initial index file and js file are served ok but then we start getting errors which makes me beleive ssl is fine even if there is a trust issue because I didnt put a SAN section in this cert:

Server initialized for asgi.
INFO: Started server process [352970]
INFO: Waiting for application startup.
INFO: Application startup complete.
INFO: Uvicorn running on https://127.0.0.1:5000/ (Press CTRL+C to quit)
UtV-Zj0tDtfPK9SIAAAA: Sending packet OPEN data {'sid': 'UtV-Zj0tDtfPK9SIAAAA', 'upgrades': ['websocket'], 'pingTimeout': 20000, 'pingInterval': 25000}
INFO: 127.0.0.1:42276 - "GET /socket.io/?EIO=4&transport=polling&t=O8biyBG HTTP/1.1" 200 OK
https://localhost:5000/ is not an accepted origin. (further occurrences of this error will be logged with level INFO)
INFO: 127.0.0.1:42276 - "POST /socket.io/?EIO=4&transport=polling&t=O8biyCd&sid=UtV-Zj0tDtfPK9SIAAAA HTTP/1.1" 400 Bad Request
https://localhost:5000/ is not an accepted origin.
INFO: ('127.0.0.1', 42282) - "WebSocket /socket.io/" 403
https://localhost:5000/ is not an accepted origin.
INFO: 127.0.0.1:42286 - "POST /socket.io/?EIO=4&transport=polling&t=O8biyDm&sid=UtV-Zj0tDtfPK9SIAAAA HTTP/1.1" 400 Bad Request
K3rC6Z3kBMwA-QYpAAAB: Sending packet OPEN data {'sid': 'K3rC6Z3kBMwA-QYpAAAB', 'upgrades': ['websocket'], 'pingTimeout': 20000, 'pingInterval': 25000}

And the following console errors:

[CS] start
contentScript.bundle.js:1 [CS] [ExtensionFrameHandle] enter
contentScript.bundle.js:1 [CS] dataError = 4
E.ExtensionFrameHandle @ contentScript.bundle.js:1
E.GetExtInfoCallback @ contentScript.bundle.js:1
E.GetExtInfoCallback @ contentScript.bundle.js:1
socket.io/?EIO=4&transport=polling&t=O8blHxZ&sid=XNUVUT2VkUwP1FfwAAAA:1 Failed to load resource: the server responded with a status of 400 (Bad Request)
index2.js:28 disconnected
24WebSocket connection to '' failed: WebSocket is closed before the connection is established.

I am using python-socketio version:

Name: python-socketio
Version: 5.7.1

With uvicorn version:

Name: uvicorn
Version: 0.13.2

And client socketio:

https://cdnjs.cloudflare.com/ajax/libs/socket.io/4.5.1/socket.io.min.js

I have been trying to figure out if this is a CORS issue due to the above error:

https://localhost:5000/ is not an accepted origin.

But looking at request headers and response it looks to be formatted ok as far as I can tell. I found another post where he was using it behind nginx and talking about proxy_params and tried creating headers in uvicorn but no joy with that helping

Where should I look next, I am starting to bang my head against the wall, I have upgraded python-socketio and socketio client to latest version and I am having the same problem. Please advise on your thoughts or if you need more information.

Kind Regards

Ben Butler

[Merlin673]

omg, I think I have fixed it with:

cors_allowed_origins='*'

Added to the python aysnc file:

sio = socketio.AsyncServer(logger=True, engineio_logger=True, async_mode='asgi', cors_allowed_origins='*')

Thanks for helping inspiration strike.

Kind Regards

Ben Butler

[miguelgrinberg]

Ben, the problem is right there in your logs:

https://localhost:5000/ is not an accepted origin.

Your solution is not great though, as you are basically disabling the cross-origin protections completely. The correct thing to do is add cors_allowed_origins=['http://localhost:5000/'] to your server, so that only this one origin is allowed.

Also, may I ask you to not write issues on this board when you have questions? There is a discussions board for questions, this board is for bugs. Thank you.