如何调整NGINX配置解决WSS连接返回500内部错误问题

配置错误点 #

现有NGINX配置里存在4处直接导致wss连接500错误的问题：

• map块语法错误：定义$connection_upgrade变量时用了无效的反引号，应该改为空字符串匹配逻辑
• WebSocket的Connection头配置错误：写死为固定值upgrade，没有使用map生成的动态变量
• 80端口跳转配置冲突：同server块下同时存在301跳转和404返回规则，逻辑冲突
• 443端口server_name配置不匹配：配置为默认通配_，和SSL证书绑定的域名不一致

修复后的完整配置 #

user www-data;
worker_processes auto;
pid /run/nginx.pid;

events {
        worker_connections 768;
}

http {
    sendfile on;
    tcp_nopush on;
    tcp_nodelay on;
    keepalive_timeout 65;
    types_hash_max_size 2048;
    
    include /etc/nginx/mime.types;
    default_type application/octet-stream;

    client_max_body_size 100M;
    
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_prefer_server_ciphers on;

    access_log /var/log/nginx/access.log;
    error_log /var/log/nginx/error.log;

    gzip on;

    # 修复1：修正map块语法
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream websocket {
        server 127.0.0.1:5000;
    }


    server {
        listen [::]:443 SSL;
        listen 443 SSL;
        root /var/www/html;
        ssl on;

        index index.html index.htm index.nginx-debian.html;
        # 修复2：替换为你的实际域名，和SSL证书匹配
        server_name <domain>;

        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        location /socket {
            proxy_pass http://websocket;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            # 修复3：使用动态生成的Connection头变量
            proxy_set_header Connection $connection_upgrade;
        }

        # SSL Settings by Certbot
        ssl_certificate /etc/letsencrypt/live/<domain>/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/<domain>/privkey.pem;
        include /etc/letsencrypt/options-ssl-nginx.conf;
        ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
    }


    server {
        # Redirect HTTP to HTTPS
        listen 80 ;
        listen [::]:80 ;
        server_name <domain>;
        # 修复4：删除冲突的return 404规则，保留301跳转
        return 301 https://$host$request_uri;
    }
}

生效步骤 #

1. 替换配置中所有<domain>为你的实际域名
2. 执行nginx -t验证配置语法正确性
3. 执行systemctl reload nginx重载配置生效

内容的提问来源于stack exchange，提问作者Hultan