converse

Sept. 8, 2018

Converse.js with prosody

Since the latest release (4.0.0), converse.js supports OMEMO. With OMEMO and MAM (server side message archive to show older chatlogs), it seems to be now a really nice client for everyday usage.

But deploying it isn't as easy as one might think. Here a short summary what I needed to do to get BOSH and HTTP file upload working together with an own prosody XMPP server.

By default the prosody BOSH (Jabber over HTTP) server listens on port 5280 and 5281 for unencrypted respectively TLS connections.
When converse.js is installed on a webserver, the website at port 80 (HTTP) / 443 (HTTPS) is considered as another origin by the browser, so it will not allow access to the BOSH server.
The BOSH server can allow such an access by setting a cross-origin resource sharing header (CORS).

The problem is, that setting the header is not yet implemented in prosody.

To fix this, here is an easy patch for the net/http/server.lua file from prosody:

To allow access from any website, change the line

headers = { date = date_header, connection = response_conn_header };

to

headers = { date = date_header, connection = response_conn_header, 
            access_control_allow_origin = "*" };

This solves the problem to access the BOSH server, but HTTP file upload will still have problems.


HTTP file upload uses the PUT method on the server, with the new filename, which does not exist, yet.
A CORS-request by the browser before the upload results in an error 404 (File not found) and fails even when the correct header is set, so no upload is attempted.
This means the cross-origin header solution does not allow for working file transfers.

To solve the problem, we can use a reverse proxy to have the BOSH and HTTP-upload URLs on the same domain (and port) as the converse.js installation.
The patch for sending the cross-origin resource sharing header above is no longer needed with this solution, as everything will now run on the same domain and port.

For nginx, I use the following reverse proxy configuration for the vHost CONVERSE_DOMAIN at which converse.js is hosted:

# BOSH
location ^~ /http-bind {
    proxy_pass "https://PROSODY_SERVER:5281/http-bind";
    proxy_http_version 1.1;
    proxy_set_header Host JABBER_DOMAIN;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffering off;
    tcp_nodelay on; 
}
# HTTP-Upload
location ^~ /upload {
    proxy_pass "https://PROSODY_SERVER:5281/upload";
    proxy_http_version 1.1;
    proxy_set_header Host JABBER_DOMAIN;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_buffering off;
    tcp_nodelay on; 
}

where JABBER_DOMAIN needs to be the appropriate vHost in prosody, i.e. the part after the @ in the jabber IDs, and PROSODY_SERVER is the IP or hostname where nginx can access the prosody server.

In prosody, the following configuration is needed

# Consider internal non-https connections as external https connections
consider_bosh_secure = true;
# Allow requests from other domains than the @server part of the jabber IDs
cross_domain_bosh = true;
# Base URL used to generate HTTP-upload URLs
http_external_url = "https://CONVERSE_DOMAIN/"

This configuration makes prosody accept connections from nginx, even when the internal connection does not use HTTPS and sets the base URL which is used to construct URLs for file uploads to the external address of the reverse proxy.

You can now firewall the prosody HTTP-server, as BOSH and HTTP file upload should only need access the nginx HTTP server.

Kategorien Tipps Software Technik
Tagged prosody converse.js converse nginx reverse proxy OMEMO MAM Jabber
Mobil qrcode zeigen

0 Kommentare