noVNC working but getting connection timeout on /vncproxy

[lubr]

Hi,

I have followed https://forum.proxmox.com/threads/how-to-set-up-novnc-on-a-web-application.123701/ to implement noVNC console some time ago. Everything is working but:

1) in PVE I have noticed two same /vncproxy calls where the first one has connection timeout and second is connected,
2) I realized I do not need /vncwebsocket call to load noVNC in iframe
3) no matter if I use $ticket from login or ticket from vncproxy call, it works for both situations

Check comments in code:

// ad 1) this is 2x in PVE proxy, first connection timeout (maybe due to being killed by second call)
$config = $proxmox->create("/nodes/$node/qemu/$vmid/vncproxy", [
    'websocket' => 1, // Start websocket proxy
]);

// ad 2) I can comment this out and nothing will be broken because i can use $config['data']['ticket'] and $config['data']['port'] in iframe link directly to make it work
$websock = $proxmox->get("/nodes/$node/qemu/$vmid/vncwebsocket", [
     'vncticket' => $config['data']['ticket'],
     'port' => $config['data']['port']
]);

// ad 3) here I am using $config['data']['ticket'] instead of $ticket of login
$src_href = 'https://'.$host.':8006/?console=kvm&novnc=1&node='.$node.'&resize=1&vmid='.$vmid.'&path=api2/json/nodes/'.$node.'/qemu/'.$vmid.'/vncwebsocket/port/'.$config['data']['port'].'"/vncticket/"'.$ticket;

echo '<iframe src="'.$src_href.'" frameborder="0" scrolling="no" width="100%" height="100%"></iframe>';

Can someone explain why it behaves like that and what steps are really required for noVNC in iframe?

 

[lubr]

I have found some answers to questions above:

Ad 1) Because this part of code (taken from https://forum.proxmox.com/threads/how-to-set-up-novnc-on-a-web-application.123701/ tutorial) mixes two different approaches, first proxy call is called in

$config = $proxmox->create("/nodes/$node/qemu/$vmid/vncproxy", [
    'websocket' => 1, // Start websocket proxy
]);

and second in IFRAME link itself in

$src_href = 'https://'.$host.':8006/?console=kvm&novnc=1&node='.$node.'&resize=1&vmid='.$vmid.'&path=api2/json/nodes/'.$node.'/qemu/'.$vmid.'/vncwebsocket/port/'.$config['data']['port'].'"/vncticket/"'.$ticket;

Therefore first /vncproxy all is killed by call from IFRAME.

Ad 2) This part would be required only if non-IFRAME solution was used. So it can be removed (use hardcoded port 5900 in IFRAME link).

Ad 3) Both ticket or vncTicket is not needed since cookie where this ticket is stored is used.

So the result of the code above could be as follows:

 setcookie("PVEAuthCookie",$ticket, 0, "/", '.domain' );

// ad 3) here I am using $config['data']['ticket'] instead of $ticket of login
$src_href = 'https://'.$host.':8006/?console=kvm&novnc=1&node='.$node.'&resize=1&vmid='.$vmid.'&path=api2/json/nodes/'.$node.'/qemu/'.$vmid.'/vncwebsocket/port/5900;
echo '<iframe src="'.$src_href.'" frameborder="0" scrolling="no" width="100%" height="100%"></iframe>';

The only reason why to have an extra call of 1) is to get PVEVNC ticket instead of PVE ticket for authorization. But it generates that extra /vncproxy call on Proxmox side which is being killed immediately.

Am I right?

 

[ultrasive]

setcookie("PVEAuthCookie",$ticket, 0, "/", '.domain' );

Setting my cookie on both the domain the Iframe is embeded on and the URL of the Proxmox cluster I still get the permission denied - invalid PVE ticket.

I'm using the correct ticket for the cookie (Removed some)
```
PVEVNC:673BAF77::doJ/a49h2lAbUXmyC4j3JYpy+Hzm0UxYDvnBnbTTw0tKsuN6GGpB7ia8tQo6WLzyicBPpJA==
```