Error during WebSocket handshake: Unexpected response code: 403 on NODEJS

[HanKizz]

import { createClient, Message } from 'graphql-ws';

import * as WebSocket from 'ws';
let url = 'wss://abc/graphql'

class MyWebSocket extends WebSocket {

  constructor(address, protocols) {
    super(address, protocols, {
      protocolVersion: 13,
      origin: "https://www.abc.com",
      headers: {
        // your custom headers go here
        'Accept-Encoding': 'gzip, deflate, br', 
        'Accept-Language': 'en-US,en;q=0.9,vi;q=0.8', 
        'Pragma': 'no-cache', 
        'Upgrade': 'websocket', 
        'User-Agent': 'Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/105.0.0.0 Safari/537.36',
      },
    });
  }
}

let client = createClient({
    url,
    webSocketImpl: MyWebSocket,
    keepAlive: 10_000,
    connectionAckWaitTimeout: 10000,
    retryAttempts: 10,
    generateID: () => {
        return "xxxxxxxx-xxxx-4xxx-yxxx-xxxxxxxxxxxx".replace(/[xy]/g, Qr => {
            const lr = 16 * Math.random() | 0;
            return ("x" == Qr ? lr : 3 & lr | 8).toString(16)
        })
    },
    

  })

client.on("error", (error: unknown) => {
  console.log(error)
})
client.on("connecting", () => {
  console.log("connecting")
})
client.on("opened", (socket: unknown) =>{
  console.log(socket)
})
client.on("message",  (message: Message) => {
  console.log(message)
})
client.on("closed",()=>{
  console.log("closed")
})

client.on("connected",()=>{
  console.log("connected")
})

client.on("ping",()=>{
  console.log("ping")
})

I have using graphql-ws on nodejs but when i run it, it only return code 403. Even though the server I want to connect to doesn't require authentication
Retest on postman websocket and reactjs it work. But nodejs still get error!
Please help me check
Thanks!

[enisdenjo]

Does it work if you use WebSocket instead of MyWebSocket? Can you share the full error from the error event and the close event from the close event?

Also, maybe share your server implementation?

[enisdenjo]

There is no server implementation in the nodejs folder, just the client you showcased.

The server is blocking the WS request and responding with a HTTP status code 403, therefore I need to check the server implementation to see why it gets blocked.

P.S. no need to share access credentials, code examples should suffice!

[enisdenjo]

If you make a curl request to https://api.csgoroll.com/graphql, it also gets denied with a 403. This is not an issue with WebSockets, the server is denying all HTTP requests not originating from the website itself.

$ curl --head https://api.csgoroll.com/graphql

HTTP/2 403
date: Wed, 21 Sep 2022 09:27:46 GMT
content-type: text/html; charset=UTF-8
cf-chl-bypass: 1
permissions-policy: accelerometer=(),autoplay=(),camera=(),clipboard-read=(),clipboard-write=(),fullscreen=(),geolocation=(),gyroscope=(),hid=(),interest-cohort=(),magnetometer=(),microphone=(),payment=(),publickey-credentials-get=(),screen-wake-lock=(),serial=(),sync-xhr=(),usb=()
cache-control: private, max-age=0, no-store, no-cache, must-revalidate, post-check=0, pre-check=0
expires: Thu, 01 Jan 1970 00:00:01 GMT
x-frame-options: SAMEORIGIN
server: cloudflare
cf-ray: 74e1c4540f07781c-VIE
alt-svc: h3=":443"; ma=86400, h3-29=":443"; ma=86400

[HanKizz]

If you make a curl request to https://api.csgoroll.com/graphql, it also gets denied with a 403. This is not an issue with WebSockets, the server is denying all HTTP requests not originating from the website itself.

Thanks for reply. If it deny all request from other site. Why i test it on postman it work ? It's weird
I also used graphql-ws on localhost reactjs or javascript. It still works and connects successfully.

This proves that the server can be called from other websites!

[enisdenjo]

If it deny all request from other site. Why i test it on postman it work ?

I cannot answer this question without seeing the server implementation. Whatever the case is, the problem is not with WebSockets - the server decides to deny some requests.

[HanKizz]

If it deny all request from other site. Why i test it on postman it work ?

I cannot answer this question without seeing the server implementation. Whatever the case is, the problem is not with WebSockets - the server decides to deny some requests.

Thanks for reply. I think it is bug on nodejs!