# Secure websocket connection to SpringBoot fails with 403 if behind Traefik

**URL:** <https://community.traefik.io/t/secure-websocket-connection-to-springboot-fails-with-403-if-behind-traefik/13415>\
**Category:** Traefik v2\
**Tags:** docker\
**Created:** [February 11, 2022, 9:59am UTC](https://community.traefik.io/t/secure-websocket-connection-to-springboot-fails-with-403-if-behind-traefik/13415 "2022-02-11T09:59:56Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![ctonsing](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ctonsing/32/4922_2.png) [@ctonsing](https://community.traefik.io/u/ctonsing)\
**Post date:** [February 11, 2022, 9:59am UTC](https://community.traefik.io/t/secure-websocket-connection-to-springboot-fails-with-403-if-behind-traefik/13415/1 "2022-02-11T09:59:56Z")

</div>

Hi guys, my web frontend connects to a websocket served from my backend (SpringBoot app). When I run on local dev setup (without Traefik) everything works fine. The frontend creates a connection to e.g. wss://www.example.com/ws/connect. SpringBoot checks the incoming connect request for same origin. It correctly sees the incoming request for:  
scheme: https  
port: 443  
host: [www.example.com](http://www.example.com)

and origin:  
scheme: https  
port: 443  
host: [www.example.com](http://www.example.com)

On the live setup, I have the SpringBoot app running behind Traefik, so all http/https traffic goes through Traefik to the app. Now when the websocket connect request comes in, SpringBoot sees request for:  
scheme: http  
port: 443  
host: [www.example.com](http://www.example.com)

and origin:  
scheme: https  
port: 443  
host: [www.example.com](http://www.example.com)

As you can see, everything is correct except the request scheme, which is http and not https, so the same origin policy fails and the frontend gets a 403 response.

It would seem to me that Traefik is making a mistake here?

Any help would be appreciated.

---

<div class="post-metadata">

**Author:** ![ctonsing](https://sea2.discourse-cdn.com/flex020/user_avatar/community.traefik.io/ctonsing/32/4922_2.png) [@ctonsing](https://community.traefik.io/u/ctonsing)\
**Post date:** [February 11, 2022, 3:11pm UTC](https://community.traefik.io/t/secure-websocket-connection-to-springboot-fails-with-403-if-behind-traefik/13415/2 "2022-02-11T15:11:39Z")

</div>

Hmm, seems the problem was that Spring needs to check the X-Forward-Proto header which is set by Traefik to wss. Sorry for the false alarm 🙈