# How to resolve wss "Error during WebSocket handshake: Unexpected response code: 502"

**URL:** <https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362>\
**Category:** Help\
**Created:** [October 10, 2020, 11:57am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362 "2020-10-10T11:57:57Z")\
**Posts on this page:** 11\
**Page:** 1

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 10, 2020, 11:57am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/1 "2020-10-10T11:57:57Z")

</div>

I am using docker on Ubuntu 20.04 and used docker-compose built a bitwardenrs container.  
The web vault was ok , but the wss connect was notworking.  
This is my docker-compose

```auto
version: '3'

services:
  bitwarden:
    image: bitwardenrs/server
    container_name: bitwarden
    restart: always
    volumes:
      - ./data:/data
    environment:
      WEBSOCKET_ENABLE: 'true'
      SIGNUPS_ALLOWED: 'false'
      WEB_VAULT_ENABLE: 'true'
      #ADMIN_TOKEN: ''
    ports:
      - "127.0.0.1:33687:80"
      - "127.0.0.1:33688:3012"
    labels:
      - "traefik.frontend.headers.frameDeny=true"

```

## my nginx config

```nginx
upstream docker_bw {
    server 127.0.0.1:33687;
}
upstream docker_bw_socket {
    server 127.0.0.1:33688;
}
...
location /notifications/hub {
        proxy_pass http://docker_bw_socket;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
    location / {
        proxy_pass http://docker_bw;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location /notifications/hub/negotiate {
        proxy_pass http://docker_bw;
    }
....

```

but the wss connections always return 502 , and this is the nginx error log

```auto

2020/10/10 19:43:43 [error] 210875#210875: *47 recv() failed (104: Connection reset by peer) while reading response header from upstream, client: 192.168.2.2, server: xxxxxxxx, request: "GET /notifications/hub?access_token=xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx HTTP/1.1", upstream: "http://127.0.0.1:33688/notifications/hub?access_token=xxxxxxxxxxxxxxxxxxxxx

```

how to resolve that , help please, and does the wss is required ?

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [October 11, 2020, 7:19am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/2 "2020-10-11T07:19:03Z")

</div>

I’m not sure but what does the traefik label do?  
Could that manipulate the http?  
What happens if you remove that?

---

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 11, 2020, 10:03am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/3 "2020-10-11T10:03:08Z")

</div>

yeah, that traefik not working so i removed that. but wss still error

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [October 11, 2020, 10:29am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/4 "2020-10-11T10:29:25Z")

</div>

On the host where nginx is installed could you try to run the following?

```auto
curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" "http://127.0.0.1:33688/notifications/hub"

```

This will not work, but you should get something like this:

```auto
HTTP/1.1 400 Bad Request
WebSocket Protocol Error: Unable to parse WebSocket key.

```

---

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 11, 2020, 10:39am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/5 "2020-10-11T10:39:29Z")

</div>

```auto
➜ curl -i -N -H "Connection: Upgrade" -H "Upgrade: websocket" "http://127.0.0.1:33688/notifications/hub"
curl: (52) Empty reply from server

```

and i use docker exec command into the contain

```auto
docker exec -i -t bitwarden curl 127.0.0.1:3012
# curl: (7) Failed to connect to 127.0.0.1 port 3012: Connection refused

```

that seem like contain does not start wss server , i do not know what happened

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [October 11, 2020, 10:54am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/6 "2020-10-11T10:54:14Z")

</div>

Could you check your bitwarden.log file?  
It should state that it started both web and websocket ports.

---

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 11, 2020, 11:03am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/7 "2020-10-11T11:03:27Z")

</div>

thanks a lot. but i can not find logs file at /data or /var/log, and i use `find / -name bitwarden*` just found a **bitwarden\_rs** , i think that is a executable binary

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [October 11, 2020, 11:10am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/8 "2020-10-11T11:10:01Z")

</div>

That should be in your /data folder where the sqlite database is stored also.  
So in your case `./data` if i’m correct. Else try `docker logs bitwarden | less` at the top you should see which version there is running, but also a few lines like this.

```auto
[2020-10-10 21:49:31.507][ws][INFO] Listening for new connections on 0.0.0.0:3012.
[2020-10-10 21:49:31.507][start][INFO] Rocket has launched from http://0.0.0.0:80

```

Could you check that?

---

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 11, 2020, 11:26am UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/9 "2020-10-11T11:26:46Z")

</div>

yeah , but just only running port 80

```auto
[start][INFO] Rocket has launched from http://0.0.0.0:80
[2020-10-11 11:12:17.419][request][INFO] POST /api/accounts/prelogin

```

i do not know why do not start wss server

---

<div class="post-metadata">

**Author:** ![BlackDex](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/blackdex/32/8_2.png) [@BlackDex](https://vaultwarden.discourse.group/u/BlackDex)\
**Post date:** [October 11, 2020, 1:11pm UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/10 "2020-10-11T13:11:10Z")

</div>

@ytbforpre, it’s a very nasty one why it doesn’t start ;).  
That variable has to be with a `D` in the end.

```auto
WEBSOCKET_ENABLED=true

```

The same for

```auto
WEB_VAULT_ENABLED=true

```

btw.

---

<div class="post-metadata">

**Author:** ![ytbforpre](https://yyz2.discourse-cdn.com/free1/user_avatar/vaultwarden.discourse.group/ytbforpre/32/166_2.png) [@ytbforpre](https://vaultwarden.discourse.group/u/ytbforpre)\
**Post date:** [October 11, 2020, 2:01pm UTC](https://vaultwarden.discourse.group/t/how-to-resolve-wss-error-during-websocket-handshake-unexpected-response-code-502/362/11 "2020-10-11T14:01:02Z")

</div>

yep, i read the bitwarden\_rs github wiki and i saw that, **WEBSOCKET\_ENABLED** , lol  
that things tell me do not copy something from unofficial articles.  
at last, thanks a lot for helping