0Pricing
WebSockets & Real-Time Systems with Spring · 课时

使用 TLS 和 wss:// 加密流量

通过使用 TLS 提供连接，并在 Spring 应用中将 ws:// 升级为安全的 wss:// 方案，保护传输中的 WebSocket 数据。

使用 TLS 和 wss:// 加密流量 是 CoddyKit 上的免费 WebSockets & Real-Time Systems with Spring 课时。 这是第 4 节课，共 4 节。 你可以在下方免费阅读本课时的完整内容 — 然后在浏览器中使用内置代码编辑器和全天候 AI 导师进行实践。 这是 WebSockets & Real-Time Systems with Spring 学习路径的一部分，你的进度在网页和 CoddyKit 应用中同步。 WebSockets & Real-Time Systems with Spring 课程共包含 4 节课。

本课时的部分内容尚未翻译，以英文显示。

Why Plain ws:// Is Risky

A WebSocket opened over ws:// sends every frame as plaintext. Anyone on the network path can read or tamper with the messages.

For any real application you must encrypt the channel, just as you would with HTTPS.

Introducing wss://

The wss:// scheme is WebSocket over TLS. It is the exact analogue of https://: the handshake and all subsequent frames travel inside an encrypted tunnel.

  • ws:// → http://
  • wss:// → https://

TLS Terminates Where HTTPS Does

Because the WebSocket handshake is an HTTP upgrade request, enabling HTTPS on your Spring server automatically secures the upgrade. The same certificate protects both REST and WebSocket traffic.

Generating a Keystore

Spring Boot reads a Java keystore (PKCS12 or JKS) for its TLS material. For local testing you can self-sign one with the JDK keytool.

keytool -genkeypair -alias coddy -keyalg RSA -keysize 2048 \
  -storetype PKCS12 -keystore keystore.p12 -validity 365

Configuring TLS in application.properties

Point Spring Boot at the keystore and enable SSL. After this the embedded server speaks HTTPS, so wss:// works out of the box.

server.port=8443
server.ssl.enabled=true
server.ssl.key-store=classpath:keystore.p12
server.ssl.key-store-type=PKCS12
server.ssl.key-store-password=changeit
server.ssl.key-alias=coddy

Connecting from the Browser

The client simply uses the secure scheme. The browser performs the TLS handshake before the WebSocket upgrade.

const socket = new WebSocket('wss://api.example.com:8443/ws');
socket.onopen = () => console.log('Secure socket open');

Mixed Content Rules

Browsers enforce mixed content policy: a page loaded over https:// may only open wss:// sockets, never ws://. Always match the page scheme to the socket scheme.

Terminating TLS at a Proxy

In production TLS is often terminated at a reverse proxy (Nginx, an ALB). The proxy holds the certificate and forwards plain traffic internally. Ensure it forwards the Upgrade and Connection headers or the handshake fails.

location /ws {
  proxy_pass http://backend:8080;
  proxy_http_version 1.1;
  proxy_set_header Upgrade $http_upgrade;
  proxy_set_header Connection "upgrade";
}

Certificate Renewal

TLS certificates expire. Use an automated issuer such as Let's Encrypt with auto-renewal so long-lived WebSocket clients never hit an expired cert. Plan reconnection logic for the brief moment a proxy reloads.

Enforcing Secure Connections in Spring

You can reject any non-TLS request at the security layer so a misconfigured client cannot fall back to plaintext.

http.requiresChannel(channel -> channel.anyRequest().requiresSecure());

Strong Cipher Configuration

Beyond enabling TLS, restrict to modern protocols and ciphers. Disable TLS 1.0/1.1 and prefer forward-secret suites.

server.ssl.enabled-protocols=TLSv1.3,TLSv1.2
server.ssl.ciphers=TLS_AES_256_GCM_SHA384,ECDHE-RSA-AES256-GCM-SHA384

Quick Check

Test your understanding of secure WebSocket transport.

Recap

You secured WebSocket traffic in transit:

  • wss:// is WebSocket over TLS, the analogue of HTTPS
  • Enabling SSL in Spring Boot secures the handshake automatically
  • HTTPS pages must use wss:// (mixed content rules)
  • Proxies must forward the Upgrade header when terminating TLS
  • Enforce secure channels and modern ciphers, and automate renewal

常见问题解答

「使用 TLS 和 wss:// 加密流量」课时是免费的吗？

是的 — 「使用 TLS 和 wss:// 加密流量」的完整文本可在网页上免费阅读。要进行交互式练习（内置代码编辑器和全天候 AI 导师）并解锁 WebSockets & Real-Time Systems with Spring 课程的其余内容，请升级到 CoddyKit PRO。 WebSockets & Real-Time Systems with Spring 课程共包含 4 节课。

「使用 TLS 和 wss:// 加密流量」这节课中我会学到什么？

通过使用 TLS 提供连接，并在 Spring 应用中将 ws:// 升级为安全的 wss:// 方案，保护传输中的 WebSocket 数据。 你通过在浏览器中直接运行的动手代码来练习 WebSockets & Real-Time Systems with Spring，全天候 AI 导师会在你学习这节课的过程中回答你的问题。

学习 WebSockets & Real-Time Systems with Spring 需要有经验吗？

无需任何先前经验。CoddyKit 上的 WebSockets & Real-Time Systems with Spring 课程适合初学者到高级学习者，你可以从这里开始或从头开始，按照自己的节奏学习。 这是第 4 节课，共 4 节。

「使用 TLS 和 wss:// 加密流量」课时需要多长时间？

大多数 CoddyKit 课程大约需要 5–10 分钟。每节课都很精短且互动，所以你能稳步进步，并在网页和应用中从离开的地方继续。

我能在这节 WebSockets & Real-Time Systems with Spring 课中编写并运行代码吗？

能。每节 WebSockets & Real-Time Systems with Spring 课都包含内置代码编辑器，你可以在浏览器中直接编写并运行真实代码，并获得即时 AI 反馈 — 无需本地设置。

此课程中的所有课时

  1. WebSocket 安全考量
  2. 集成 Spring Security
  3. 身份验证与授权
  4. 使用 TLS 和 wss:// 加密流量
← 返回 WebSockets & Real-Time Systems with Spring