SSL环境下Django Channels生产部署WebSocket连接失败求助

一、检查Nginx WSS代理配置 #

确保Nginx正确处理WebSocket的升级请求和SSL头，以下是标准配置：

server {
    listen 443 ssl;
    server_name sample.com;

    ssl_certificate /path/to/your/cert.pem;
    ssl_certificate_key /path/to/your/privkey.pem;

    # 其他SSL相关配置...

    location /ws/ {
        proxy_pass http://127.0.0.1:8000;  # 对应Daphne监听的地址端口
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;  # 传递SSL协议信息给后端

        # 延长超时时间，避免上游连接提前关闭
        proxy_connect_timeout 7d;
        proxy_send_timeout 7d;
        proxy_read_timeout 7d;
    }

    # 静态文件、Django普通请求的配置...
}

二、调整Django/Channels配置 #

1. 在settings.py中添加反向代理信任配置：

# 信任Nginx传递的SSL协议头
SECURE_PROXY_SSL_HEADER = ('HTTP_X_FORWARDED_PROTO', 'https')
USE_X_FORWARDED_HOST = True
USE_X_FORWARDED_PORT = True

# 确保Channels配置正确
ASGI_APPLICATION = "your_project.asgi.application"
CHANNEL_LAYERS = {
    "default": {
        "BACKEND": "channels_redis.core.RedisChannelLayer",
        "CONFIG": {
            "hosts": [("127.0.0.1", 6379)],  # Redis地址，需确保Redis正常运行
        },
    },
}

2. 确认ASGI应用文件（如asgi.py）正确配置：

import os
from django.core.asgi import get_asgi_application
from channels.routing import ProtocolTypeRouter, URLRouter
from channels.auth import AuthMiddlewareStack
import your_app.routing

os.environ.setdefault('DJANGO_SETTINGS_MODULE', 'your_project.settings')

application = ProtocolTypeRouter({
    "http": get_asgi_application(),
    "websocket": AuthMiddlewareStack(
        URLRouter(
            your_app.routing.websocket_urlpatterns
        )
    ),
})

三、优化前端WebSocket连接逻辑 #

确保仅在连接就绪后发送消息，避免在CONNECTING状态调用send：

// 自动适配协议，兼容HTTP/HTTPS环境
const wsProtocol = window.location.protocol === 'https:' ? 'wss:' : 'ws:';
const chatSocket = new WebSocket(
    wsProtocol + '//' + window.location.host + '/ws/chat/room/'
);

// 监听连接成功事件，就绪后再发送消息
chatSocket.onopen = function() {
    console.log('WebSocket连接已建立');
    chatSocket.send(JSON.stringify({
        'message': '进入房间'
    }));
};

// 发送消息前强制检查连接状态
document.getElementById('send-btn').addEventListener('click', function() {
    if (chatSocket.readyState !== WebSocket.OPEN) {
        alert('连接未就绪，请稍候');
        return;
    }
    const input = document.getElementById('message-input');
    const message = input.value.trim();
    if (message) {
        chatSocket.send(JSON.stringify({'message': message}));
        input.value = '';
    }
});

// 监听错误和关闭事件，便于排查问题
chatSocket.onerror = function(error) {
    console.error('WebSocket错误:', error);
};

chatSocket.onclose = function(event) {
    console.error('WebSocket连接关闭:', event.code, event.reason);
};

四、额外排查点 #

• 检查服务器防火墙：确保Daphne监听的端口（如8000）允许Nginx内部访问，同时开放443端口的WSS流量
• 验证Redis服务：执行redis-cli ping，确保Redis正常运行，Channels依赖Redis处理WebSocket消息路由
• 查看Daphne日志：如果用systemd管理Daphne，执行journalctl -u daphne.service查看是否有连接报错
• 检查SSL证书：确保证书有效、完整（包含证书链），避免客户端因证书验证失败拒绝连接

内容的提问来源于stack exchange，提问作者Tio