We wanted to add an authentication step before accessing static and socket.io served by node.js. But stock port redirections do not work.

Because websockets breaks HTTP 1.1 protocol, Nginx was unable to complete the task. So we used HAProxy with his tcp mode and a small test to identify and redirect websocket connections.

# /etc/haproxy/haproxy.cfg (snippet)
# ACL & Auth for connect and socket.io front end
userlist UsersAuth
  group admin users admin
  user admin insecure-password mypassword
# Setup the listenning port 
frontend all 0.0.0.0:80
    timeout client 86400000
    default_backend www_papou
    acl is_websocket hdr(Upgrade) -i WebSocket
    use_backend socket_backend if is_websocket
# web partbackendbackend www_papou
    balance roundrobin
    option      forwardfor # This sets X-Forwarded-For
    option    httplog             
    timeout server 30000
    timeout connect 40000

    # restrict to authenticated users
    acl AuthOkay_Web http_auth(UsersAuth)
    http-request auth realm AuthYourself if !AuthOkay_Web    # forward to the real server
    server server1 localhost:8000 weight 1 maxconn 1024 check
# socket.io part
backend socket_backend
    balance roundrobin
    option tcplog
    timeout queue 5000
    timeout server 86400000
    timeout connect 86400000
    server socket localhost:8000 weight 1 maxconn 1024 check
#end config

With this setup, incomming connections on port 80 are proxy-ied to port 8000 on the node.js app and anonymous access is prohibited and delegated to the proxy.

So far, it works well using websocket transport. Indeed firewalling must be set up to prevent direct connections to port 8000.

Versions used : nodejs 0.4.10, haproxy 1.4.8 , socket.io 0.8.7