Websocket upgrade failed: 403 Forbidden autobahn asyncio

Question

I'm trying to connect to a websocket using Autobahn/Asyncio. I have connected to several other websockets using the exact same code, but this particular websocket is rejecting my attempts. I'm getting a connection upgrade failure and the server is responding with a 403. I have tried to connect to this websocket with the 'websockets' package and that has been successful, so there must be some default setting in the Autobahn implementation that is causing the problem.

I have compared the successful handshake request from the websockets implementation with the unsuccessful handshake request from the autobahn implementation:

websockets: request:

GET /ws/v3 HTTP/1.1
Host: real.okex.com:10442
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: eTj8gJmhJGTj868ObmO2qg==
Sec-WebSocket-Version: 13
Sec-WebSocket-Extensions: permessage-deflate; client_max_window_bits
User-Agent: Python/3.6 websockets/8.0

response:

Server: nginx
Date: Tue, 09 Jul 2019 20:49:33 GMT
Connection: upgrade
upgrade: websocket
sec-websocket-accept: NJxn9G+1AJaYlHY1n1/Iy6P+2R8=

autobahn: request:

GET /ws/v3 HTTP/1.1
User-Agent: AutobahnPython/18.11.1
Host: real.okex.com:10442
Upgrade: websocket
Connection: Upgrade
Sec-WebSocket-Key: QI5/tydGJRB6/LMDXkQ1dg==
Sec-WebSocket-Version: 13

response:

WebSocket connection upgrade failed (403 - Forbidden)

I have even hardcoded the autobahn implementation to send the exact same GET request as the 'websockets' implementation but that didn't work.

Autobahn code:

async def connect_to_OKEX():
    while True:
        try:
            global OKEX_transport
            ws_endpoint = 'wss://real.okex.com:10442/ws/v3'
            factory = WebSocketClientFactory(ws_endpoint)
            factory.protocol = OKEX_Protocol
            coro = loop.create_connection(factory, 'www.okex.com', 443, ssl=True)
            print("running {}".format(coro))
            OKEX_transport, proto = await coro
            print("proto {}".format(proto))
            break
        except Exception as e:
            logger.exception('OKEX error connecting')
            await asyncio.sleep(1)

websockets code:

async def subscribe_without_login('wss://real.okex.com:10442/ws/v3', channels):
    async with websockets.connect(url) as websocket:
.....

The autobahn code that I am using has worked successfully for several other websockets, so is there perhaps some flag that I need to tick which is particular to this websocket? How could I go about figuring that out?

Answer 1

I met the exactly same issue on kraken websocket , and the root cause is SNI used by cloudflare . Because the websocket upgrade handshake is same, the problem must be in TLS.

After using optionsForClientTLS(hostname) instead of ClientContextFactory to create the client websocket, the 403 problem is gone.