Issue: 401 Permission Denied - Invalid PVEVNC Ticket when Using /vncwebsocket API

[kkworkemail]

Hi everyone,

I'm currently using the Proxmox API to create a VNC proxy connection for accessing a container's console. Here's the workflow I'm following:

1. Step 1: I use the /api2/json/nodes/{node}/lxc/{vmid}/vncproxy API to generate a VNC proxy ticket and port. This step works fine, and I receive a response containing the ticket and port.
2. Step 2:I then use the /api2/json/nodes/{node}/lxc/{vmid}/vncwebsocket API to establish a WebSocket connection. For this, I pass:
   • The port returned from /vncproxy
   • The vncticket (PVEVNC ticket) returned from /vncproxy

However, when I attempt to connect to the /vncwebsocket endpoint, I receive the following error:

401 Permission Denied - Invalid PVEVNC Ticket<br>

What I’ve Tried:​

• Double-checked the ticket and port: I’m passing the exact ticket and port values returned from the /vncproxy API.
• Confirmed no suspicious logs: The logs for /vncproxy tasks show they start and end successfully with a status of OK.
• Ensured immediate use of ticket: The /vncproxy ticket is used right after being generated to avoid expiration issues.
• Checked session authentication: I’m using an API token with sufficient permissions, so the PVEAuthCookie is not required.

Logs:​

Here are the logs during my attempts:

Dec 17 17:27:55 inn-prox pvedaemon[1536]: <root@pam> starting task UPID:inn-prox:0000A7AE:000989FB:67616743:vncshell::root@pam:
Dec 17 17:27:55 inn-prox pvedaemon[42926]: starting termproxy UPID:inn-prox:0000A7AE:000989FB:67616743:vncshell::root@pam:
Dec 17 17:28:19 inn-prox pvedaemon[1536]: <root@pam> starting task UPID:inn-prox:0000A854:00099360:6761675B:vncproxy:172:root@pam:
Dec 17 17:28:19 inn-prox pvedaemon[43092]: starting lxc vnc proxy UPID:inn-prox:0000A854:00099360:6761675B:vncproxy:172:root@pam:
Dec 17 17:28:39 inn-prox pvedaemon[1536]: <root@pam> end task UPID:inn-prox:0000A854:00099360:6761675B:vncproxy:172:root@pam: OK

My Questions:​

1. Could this be a configuration issue on the Proxmox side? If so, how can I debug it further?
2. Is there a specific format or encoding required for the vncticket in the /vncwebsocket API request?
3. Are there any known limitations or quirks in Proxmox's WebSocket handling that might cause this error?

Any advice or guidance would be greatly appreciated! If someone has successfully implemented a similar flow using the Proxmox API, I'd love to hear how you approached it.

Thank you!

 

[shbaek]

https://git.proxmox.com/?p=qemu-ser...7455bb03597a94d8ca6623a962e0463;hb=HEAD#l1776
Identify the source code and you can identify the problem.