如何为Flask-Sock配置Nginx以支持wss://协议？

你的问题核心是Nginx默认未处理WebSocket的协议升级请求，只需在Nginx的server配置块中添加专门的转发规则即可解决400错误。以下是具体配置步骤：

完整Nginx配置示例 #

server {
    listen 443 ssl;
    server_name your-domain.com; # 替换为你的实际域名

    # Certbot自动生成的SSL配置（保留原有内容即可，无需修改）
    ssl_certificate /etc/letsencrypt/live/your-domain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.com/privkey.pem;
    include /etc/letsencrypt/options-ssl-nginx.conf;
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;

    # 转发普通HTTP请求到Gunicorn
    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # 关键：配置WebSocket（wss）转发规则
    location /your-websocket-path { # 替换为你的Flask-Sock端点路径，比如/ws
        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        
        # 长连接超时设置，避免Nginx主动断开WebSocket连接
        proxy_connect_timeout 7d;
        proxy_send_timeout 7d;
        proxy_read_timeout 7d;
    }
}

# 可选：强制HTTP跳转至HTTPS
server {
    listen 80;
    server_name your-domain.com;
    return 301 https://$host$request_uri;
}

配置说明 #

• proxy_http_version 1.1：WebSocket依赖HTTP/1.1协议，必须开启此配置
• Upgrade和Connection请求头：告知Nginx将连接升级为WebSocket协议，这是解决400错误的核心
• 超时设置：WebSocket为长连接，默认Nginx超时时间较短，设置长超时可避免连接被主动断开

后续操作 #

1. 将配置中的占位符替换为你的实际域名和WebSocket端点路径
2. 保存配置后，重启Nginx生效：sudo systemctl restart nginx
3. 测试wss连接，确认错误消失

内容的提问来源于stack exchange，提问作者Jiehfeng