- Ya
- 3 Septemba 2026, 20:48 UTC
- Mwandishi
- Kamo
- Ahadi ya
- 4dde535
The reported symptom was a terminal that opened and immediately said "Disconnected", with nothing to act on. Reproduced end to end: the ticket mints fine (200) and the WebSocket handshake answers 403. Spring appends its own OriginHandshakeInterceptor AFTER the application's, and with no allowed origins configured it falls back to WebUtils.isSameOrigin, which compares the browser's Origin against the scheme and port THIS SERVER sees. Behind a TLS-terminating proxy those can never agree — https://internal.host against http://internal.host:80 — so it refused every real browser while the ticket it was holding was perfectly valid. It hid unusually well, and the earlier verification is why. A handshake WITHOUT a valid ticket is refused by TerminalHandshakeInterceptor first and never reaches Spring's check, so probing the endpoint unauthenticated returned exactly the 401 it should — and proved nothing about the path a member actually takes. Every check I ran passed while the feature was broken for everyone. The origin is still checked, by TerminalHandshakeInterceptor, against the Host header, which survives the proxy. That check is the stricter of the two: it also refuses a handshake carrying no Origin at all, and it needs no per-domain list. Three tests pin the registration — the path, the interceptor, and the disabled same-origin check — so "tidying" the default back reintroduces an outage rather than a warning.