Connection problem noVNC (API)

[jnprox]

Hello,

I'm trying to run noVNC using php. I use the call: /nodes/{node}/qemu/{vmid}/vncproxy

I receive the ticket correctly. On the second call I pass the previous ticket along with the port: /nodes/{node}/qemu/{vmid}/ vncwebsocket

In this call it does not return anything.

I have tried to connect in the following way
https://domain:8006/?console=kvm&novnc=1&vmid=100&vmname=name&node=namenode
and also with a local installation of noVNC.

The error shown is "Error 401: No ticket"

Someone using the proxmox API has managed to connect using noVNC.
It is not necessary that it be with php, if someone has obtained it with another programming language it could be valid.

Thank you.

 

[dcsapak]

The error shown is "Error 401: No ticket"

you also have to be authenticated against the pve api (meaning you need a valid PVE Cookie)

 

[jnprox]

Hello, thanks for the answer

The login I do it correctly and I have the cookie "PVEAuthCookie", the rest of the requests I make work correctly. What I would like to know is if you first have to get the ticket through "vncproxy", then pass the ticket to vncwebsocket and get some type of response, according to the documentation "vncwebsocket" returns an object, but I did not return anything. What type of object does it return?

With the API I have made many calls, from creating, modifying, deleting nodes and vps, etc and I have not had any problems. If I knew that it returned the function "/nodes/{node}/qemu/{vmid}/vncwebsocket" maybe I could know if I am doing it correctly and in the case that it does not return anything, what I have to do after that call.

Thank you

 

[dcsapak]

the vncwebsocket api call is a special one (we should improve the description there)

the api call does not make sense as a normal api call (because all it does is checking the ticket), but it is used
in vnc/xtermjs as a websocket

so if you open a websocket (with a correct pve ticket as cookie, and a correct vncticket as parameter) on [...]/vncwebsocket
it gets automatically upgraded to a websocket

novnc client does this, so does the xtermjs client
maybe the source code of those to is easier to understand?
for example for xtermjs, we query /termproxy and use that info to craft a websocket url

https://git.proxmox.com/?p=pve-xter...d39ae3cbe5f7345ac74e58ed;hb=refs/heads/master

so if you want a pure php site, you have to craft this websocket url and give it to novnc (or tunnel the websocket)

 

[jnprox]

Hello, thanks for answering.

I have tried some things and I have not succeeded. I have seen the url code that you passed me. I tried to call the function of the following code

params: params,
url: url + '/ termproxy',
success: function (result) {
var port = encodeURIComponent (result.data.port);
ticket = result.data.ticket;
socketURL = protocol + location.hostname + ((location.port)? (':' + location.port): '') + '/ api2 / json' + url + '/ vncwebsocket? port =' + port + '& vncticket = '+ encodeURIComponent (ticket);
term.open (terminalContainer, true);
socket = new WebSocket (socketURL, 'binary');

and it seems that there is no "termproxy" function (I have tried to update the system, adding the repository "deb http://download.proxmox.com/debian/pve stretch pvetest" and "termproxy" does not work). I have called it in the following way "/nodes/$node/qemu/$vmid/termproxy". "vncproxy" and "termproxy" return the same? because I see that after calling "termproxy" you call "vncwebsocket" and with what you return you create the websocket, my "vncwebsocket" only returns the port and I do not know what to do with it, I have also seen that the call "vncwebsocket" you make it through the "wss" protocol, I tried to do it that way and it does not return anything to me. If you can guide me a bit more I would be very grateful.

Thank you

 

[dcsapak]

termproxy is only for serial terminals (for vms) and containers, but it does a similar job as vncproxy

vncproxy gives you a vncticket and a port

with those two things you can open a websocket on /vncwebsocket

you do not have to make a call to vncwebsocket but only use it in a websocket directly

 

[jnprox]

Thank you very much for the reply.

I have been doing several tests these days, making the calls in different ways and analyzing everything. Right now I make the call from the Websocket as you told me. And I think I know what the problem is. Here I leave you two images of connection attempts, the first is the normal error and the second is correct, the only difference between the two is that for the second I have logged in from the web of the proxmox service, this way it is created in the domain of the proxmox the cookie "PVEAuthCookie".

I have tried to create the cookie but being different domains I understand that security is not allowed. And if it is created in the domain from which I make the call, it does not pass through the Websocket. Is there any way to create that cookie? or should it be done in another way?

Thank you.

 

[dcsapak]

you create the ticket with a post call to /access/ticket which you give your credentials, then you get the ticket in the response

 

[jnprox]

Hi, thanks for responding so fast.

The rest of the functions if they work, the call to "/access/ticket" I do when I perform the login as follows:

curl_setopt ($prox_ch, CURLOPT_URL, "https://{$this->hostname}:{$this->port}/api2/json/access/ticket");

and when I make other calls I pass the ticket with curl

curl_setopt ($prox_ch, CURLOPT_COOKIE, "PVEAuthCookie =". $this->login_ticket ['ticket']);

but since the call to vncwebsocket has to be by websocket and it does not work by curl I do not have a way to pass the ticket to it, all the rest of the functions go perfectly to me. If there is any way to pass the ticket to you just like the ticketvnc was passed.

Thank you

 

[dcsapak]

you have to set it as a cookie where you connect to the websocket, it is not possible otherwise

 

[adafos]

Hi, am trying to follow directions above but when i make the vncwebsocket call with the port and ticket that i have get from vncproxy request i get

"HTTP/1.1 401 Permission denied - invalid csrf token

Am i missing something ?

 

[dcsapak]

"HTTP/1.1 401 Permission denied - invalid csrf token

Am i missing something ?

yes you also have to pass the csrftoken in the header