RDGRS-2521 — WebSocket through CloudFront to an mTLS origin

Does a browser WebSocket survive CloudFront → NLB → Envoy → backend when the origin has a client certificate attached? AWS documents WebSockets as unsupported on an origin-mTLS origin. This page runs the scenarios that actually break in production — a single successful handshake proves very little on its own.

connecting…

Scenarios

The idle test is the slow one — it waits 70 s without traffic, which is past the point most intermediaries drop a quiet connection. Leave the tab open.

Connection




What is on this host


Each row is fetched live when this page loads, so every path
below appears in the browser's Network tab with its real status and its
x-amz-cf-id — the page does not just assert that these exist.




/—this page — runs the scenarios above on load


/ws—the WebSocket endpoint (RFC 6455 echo). Over plain HTTP it serves this page


/probe—plain-text marker naming the enforcement mode —
  confirms which task answered, since a stale task during a rollout is otherwise invisible


/envoy-hc—the load-balancer health path. Answered by the proxy, never reaches the backend


/nonexistent—any other path — also the backend, which is why there is no 404




The same host is reachable directly, bypassing the CDN, but only
from an address the origin's security group admits — from anywhere else it times out at the
network layer, which looks identical to a TLS rejection. Check with nc -zv <host> 443
before reading anything into a timeout.



Drive it yourself from the browser console


The scenarios above are a fixed script. Open devtools and run
rdgrs.help() to probe something specific — a longer idle window, a larger frame,
your own payload. Replies land in the log above.


rdgrs.help()                  list everything
rdgrs.state()                 is the socket still open?
rdgrs.echo("anything")        round trip your own text
rdgrs.idle(300)               hold silent 5 min, then prove it still works
rdgrs.large(1048576)          try a 1 MB frame
rdgrs.path("/envoy-hc")       re-fetch any path, returns status + cf-id
rdgrs.ws()                    the live WebSocket object



Commands the endpoint understands


Send these as text frames from any WebSocket client
(wscat -c wss://<host>/ws) to reproduce the scenarios by hand.




echo:<text>replies echo: <text>


push:<n>sends n unsolicited frames


burst:<n>sends n numbered frames back to back


large:<n>one n-byte frame, then a largedone marker


binary:<n>an n-byte binary frame (opcode 0x2)