IIS ARR Proxy WebSockets over HTTP - iis

Question

I have a reverse proxy in our DMZ that translates wss requests into https (at least from what I can see in the IIS logs). That is, JavaScript makes a websocket request to
wss://cname.domain.com
And the reverse proxy sends it to
https://theserver.local
IIS is running on "theserver" and has an https binding. ARR is installed and has the following rewrite rules configured:
<rule name="Rewrite ssl to non-ssl" stopProcessing="true">
<condition logicalGrouping="MatchAll" trackAllCaptures="true">
<add input="{CACHE_URL}" pattern="^(.+):// />
</condition>
<match url="the_app/(.*)" />
<action type="Rewrite" url="{MapProtocol:{C:1}}://theserver.local:8080/{R:1}" />
</rule>
<rewriteMap name="MapProtocol">
<add key="https" value="http" />
<add key="wss" value="ws" />
<rewriteMap>
This should route https and wss incoming requests to the path /the_app to http://theserver:8080/{path_and_query_string} and ws://theserver:8080/{path_and_query_string} respectively.
I also have the following rewrite set up (with the highest priority) to handle these wss requests that come in over https (since I can tell which they are based on the path):
<rule name="Rewrite https to ws" stopProcessing="true">
<match url="the_app/websockets/(%7B.+%7D)" />
<action type="Rewrite" url="ws://theserver:8080/websockets/{R:1}" />
</rule>
the rewrites works perfectly...however IIS throws a 502.2 error trying to route the websockets request from https to ws (Invalid Gateway). I have turned on failed request tracing and can't seem to find any more relevant information.
Can this be made to work?

Answer 1

You need to remove the "Rewrite https to ws" rule that changes the protocol to ws:. At the HTTP level, all Websocket calls start out life as an HTTP CONNECT request with an Upgrade header. You simply need to rewrite this request so that it is forwarded to the correct server as an HTTP request, which you are already doing in your "Rewrite ssl to non-ssl" rule.