websockets and Squid

JonathanLee

Has anyone else used this custom Squid configuration to handle protocol upgrades? It allows real-time applications like Microsoft Teams, Office, and Facebook Messenger to establish WebSocket connections. Without these directives, Squid blocks the protocol upgrade request and drops the connection:

Squid

http_upgrade_request_protocols websocket allow all
http_upgrade_request_protocols OTHER deny all
Updated: see below

Please let me know if my understanding of this behavior is correct!

This has improved performance as it is helping everything run more smoothly now.

JonathanLee

I found a researched and found a more secure way I wanted to share:

acl localnet_v6 src [insert your ipv6 subnet here]
http_upgrade_request_protocols websocket allow localnet
http_upgrade_request_protocols websocket allow localnet_v6
http_upgrade_request_protocols OTHER deny all

This way only your devices can authorize the websocket requests.
follows the principal of least privilege.

JonathanLee

This fix really helps a lot with performance issues for me. Enjoy