The Apache example forwarded websocket upgrades with
`RewriteRule /ws(.*) "ws://localhost:8080/ws$1"`. The pattern is not
anchored, so `/api/ws` matches it too and is rewritten to `/ws`, the
legacy endpoint. The 3.2 client connects to `/api/ws?token=...`; through
this rule the legacy handler sees no username/password, logs in with
empty credentials and answers `system/disconnect` ("couldn't create a
new session: error response from backend: Unauthorized"), while the
server logs `invalid password` from the legacy proxy.
Forward every websocket upgrade to the same path instead. Verified with
httpd:2.4 in front of ghcr.io/m1k1o/neko/firefox:3.2.0: the old rule
reproduces the error, the new one connects the 3.2 client and still
serves legacy `/ws` clients.
Co-authored-by: Claude Fable 5.1 <noreply@anthropic.com>
SamAcctX
Miroslav Šedivý