Put Socket.IO behind NGINX by proxying its /socket.io/ endpoint with HTTP/1.1 and explicitly forwarding the WebSocket Upgrade and Connection headers. Keep the proxy’s read timeout longer than the Socket.IO heartbeat interval, and make sure any custom path is identical in the client, server, and NGINX configuration.
Need a server to try this on? Antihost offers Linux VPS plans with NVMe storage, full root access and a 14-day free trial.
For a Node.js Socket.IO server listening on 127.0.0.1:3000, this is the smallest reliable location block:
As an Amazon Associate I earn from qualifying purchases.
location /socket.io/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}How the NGINX–Socket.IO connection works
Socket.IO can begin a session with HTTP long-polling and then upgrade that session to a WebSocket. Both transports use the Socket.IO endpoint, normally /socket.io/. NGINX receives the browser request, sends it to the Node.js process, and returns the response through the public host name.
The WebSocket upgrade is different from an ordinary HTTP proxy request. Upgrade and Connection are hop-by-hop headers, so a proxy does not pass them upstream automatically. NGINX must add them explicitly. NGINX documentation describes its WebSocket tunnel mode as available since version 1.3.13, when the client requests a protocol switch and the upstream returns HTTP 101 (Switching Protocols). Without the headers, polling may work while the WebSocket handshake fails or the connection repeatedly falls back to polling.
#1 Best Overall
- [Ultra-Lightweight Ear Buds Designed for Small Ears] Each earbud weighs only 3.7g and features a compact, ergonomic in-ear design made especially for small ears. Secure, low-profile, and comfortable for workouts, all-day wear or overnight sleeping.The ultra-slim profile sits flush in your ear with no hard edges poking or rubbing, so you can even sleep on your side without discomfort.
- [Immersive Stereo Sound with TOZO OrigX Technology] TOZO OrigX tuning delivers clear vocals, balanced mids, and natural stereo sound for music, podcasts, and videos.
- [Long Battery Life for Daily Use] Get up to 7 hours of playtime on a single charge, with up to 32 hours total using the charging case—ideal for workdays, commuting, and extended listening sessions.
- [Bluetooth 5.3 & Stable Connection] Bluetooth 5.3 provides fast pairing, stable wireless performance, and reduced dropouts as you move around home or office.
- [Deep Bass with Clear Vocals] High-performance drivers produce punchy bass while keeping vocals clean and detailed for everyday listening.
Prerequisites before editing NGINX
- A running Node.js application with Socket.IO attached to an HTTP or HTTPS server.
- The address and port on which that application listens, such as
127.0.0.1:3000. The address must be reachable from the NGINX host. - A DNS name pointing to the NGINX server if clients will connect through a public host name.
- Permission to edit the active NGINX server configuration and reload the service.
- The Socket.IO path used by the server and browser client. The default is
/socket.io/; a custom path is valid only when every layer uses the same value.
Keep the Node.js listener private when NGINX is the intended entry point. If the process listens on a different interface or port, substitute that exact upstream address in proxy_pass.
Single-node configuration
Proxy only Socket.IO while NGINX serves other content
Use a dedicated location when NGINX also serves HTML, images, or other application routes. The location below leaves those routes to their existing handlers and sends only Socket.IO traffic to Node.js.
server {
listen 80;
server_name example.com;
location /socket.io/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}
}The absence of a URI suffix in proxy_pass is deliberate: NGINX forwards the complete request URI, including /socket.io/ and its query string, to port 3000. This matches Socket.IO’s default endpoint.
Proxy the whole application
If Node.js, rather than NGINX, handles every route, put the same directives in location /:
Rank #2
- 【IP68 Waterproof Multifunctinal Smart Watch】Torjalph fitness activity tracker smart watch is IP68 waterproof technology ,you can wear it when swimming,handwashing,it's rain-proof which means that you perform multiple exercise modes outside without worrying about sweat or rain corroding your fitness smart watch,and this watch equipped with a 230 mAh large capacity battery magnetic charging ,and this sports activity tracker watch can be used 5-7 days If fully charged.
- 【Larger 1.83'' Full Screen Watch & Multi-dial Selection】1.83 inch full HD color touch screen smart watch for men / women provides excellent 240*284 resolution image quality ,This Bluetooth smart watch offers a better touch experience and remarkable immersion and ,more than 200 watch faces for you to choose from App"Da Fit ", you can change the dial style according to your mood to wear keeping the world on your wrist
- 【Accurate Activity Tracker Smart Watch 】sports watch activity tracker uses sweat and dust resistant breathable silicone strap, our Fitness Tracker Smart Watch for Android iOS Phones supports 12 sports modes,walking,running,bicycle,swimming,badminton,basketball,football,rope skipping. This bluetooth calls smart watch for men women is lightweight and stylish, bringing more convenient and relaxing sports experience while also providing more protection.
- 【Your 24 Hour Personal Daily Health Monitor】Fitness watch for women men full touch screen IP67 waterproof bluetooth smartwatch for Android iOS Phones with heart rate blood pressure monitor multifunction Andriod smart watch with steps counter sleep monitor sports fitness watch, monitoring blood oxygen saturation allows you to understand your physical condition in real time to track fitness progress ,to know your health status in time.
- 【More Functions Bluetooth Call Smart Watch】This fitness activity smart watch full screen for iPhone and Android phones includes a bunch of new features including:The bluetooth smart watch can hang up the phone, receive and display WhatsAPP /Text /Facebook /Twitter /Messenger reminder.Support sedentary reminder, alarm clock, stopwatch, timer,weather information,music control, remote camera control compatible with Android 5.0 and above or iOS 9.0 and above smartphones.
server {
listen 80;
server_name example.com;
location / {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}
}Use the narrower /socket.io/ location when static files or unrelated routes should remain handled by NGINX. Use / only when the upstream is the owner of the entire site.
Validate and reload safely
- Save the server block in the configuration file included by your NGINX installation.
- Run
nginx -t. Do not reload if the test reports a syntax or include-file error. - Reload NGINX with your service manager, for example
systemctl reload nginx. - Open the application through the public host name and inspect the browser’s Network panel. A Socket.IO request should target the configured path; a WebSocket attempt should show a successful protocol switch when the client selects WebSocket transport.
- If the request fails, inspect the NGINX error log immediately after reproducing it and compare the upstream address with the address on which Node.js is listening.
What each proxy directive does
| Directive | Purpose | What breaks when it is wrong |
|---|---|---|
proxy_pass |
Selects the Node.js upstream and controls URI forwarding or replacement. | The request can reach the wrong port, or NGINX can silently rewrite the Socket.IO path. |
proxy_http_version 1.1 |
Uses HTTP/1.1 between NGINX and the upstream, which is required for WebSocket negotiation. | The upgrade handshake cannot complete reliably. |
proxy_set_header Upgrade $http_upgrade |
Copies the client’s requested protocol upgrade to the upstream. | The Node.js server sees an ordinary HTTP request instead of a WebSocket request. |
proxy_set_header Connection upgrade |
Tells the upstream that this request is changing protocols. | The upstream may reject or ignore the upgrade. |
proxy_set_header Host $host |
Preserves the public host name for application routing and origin-aware logic. | Host-based checks or generated URLs can use the internal upstream name instead. |
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for |
Adds the client address to the forwarding chain. | Application logs and client-address checks see only the proxy address. |
proxy_read_timeout |
Sets how long NGINX waits for data from an otherwise idle upstream connection. | A healthy Socket.IO connection can be closed by NGINX while waiting for the next heartbeat. |
Understand proxy_pass URI rewriting
Whether proxy_pass includes a URI after the upstream host changes the request path NGINX sends. This is a common cause of 404 responses and failed polling requests.
Quick wins for a faster PC:
Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Clear out junk files and repair common Windows errorsFree Scan →No URI suffix: forward the full path
location /socket.io/ {
proxy_pass http://127.0.0.1:3000;
}With this form, a request such as /socket.io/?transport=polling reaches Node.js with the same path and query string. It is the safest form when the Socket.IO server is mounted at its normal path.
URI suffix: replace the matched location
location /socket.io/ {
proxy_pass http://127.0.0.1:3000/realtime/;
}Here NGINX replaces the part matched by /socket.io/ with /realtime/. A request for /socket.io/ therefore arrives upstream as /realtime/. That is correct only when Socket.IO is configured to use /realtime/ on the server and in the browser client. A trailing slash in the replacement URI also affects the resulting path, so choose it intentionally rather than adding one by habit.
Rank #3
- [Low Noise High Fidelity] New bee guitar cord with 22AWG oxygen-free-copper center conductors provides enhanced signal transfer, the PVC insulation material and the high-density stranded copper double shield provide noise rejection for quiet operation
- [Ideal for Choice] New bee 1/4 straight and right angle metal connectors, ensures a secure connection in any instrument, pedal, or amp jack. L shape great fro on stage guitar stands
- [Wide Compatible] Suitable for mixer, power amplifier, microphone, effector, decoder, equalizer, electoronic organ, electric guitar, electric bass and other electronic equipments. Widely used in the installation of smart home, karaoke speaker, professional stage audio, etc
- [Easy Disassemble] Making incidental repairs quick and easy! Very nice, flexible cable
- [Dont Hesite to Order] 24 hours customer services and professional technology team are standing by
Configure a custom Socket.IO path consistently
For a custom endpoint, set the same path in all three places. The following client example uses /realtime/:
const socket = io('https://example.com', {
path: '/realtime/'
});The server-side Socket.IO constructor must use the matching path, and NGINX must match and forward it:
Do these 3 things before closing this tab:
1Fix the driver behind crashes, sound loss and screen glitches2Repair Windows errors before they cause bigger problems3Scan for outdated or missing drivers - takes under a minutelocation /realtime/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}Do not mix a default client path with a custom NGINX location, or use a replacement URI that the Socket.IO server does not recognize. Polling and WebSocket requests must resolve to the same logical endpoint.
Set a timeout that matches Socket.IO heartbeats
NGINX’s default proxy_read_timeout is 60 seconds. Socket.IO documents a default pingInterval + pingTimeout total of 45 seconds. The proxy timeout must be greater than that sum; otherwise NGINX can close an otherwise valid connection and clients report a transport close error.
Rank #4
- Digital Family Calendar: BSIMB digital calendar wall touch screen puts an end to your chaotic life. Designed for busy families, the digital calendar keeps you organised and in step with your family. Assign different colours and tasks to each family member to make family scheduling easier and more intuitive.
- Easy Setup and Auto-Sync: Plug in, connect to WLAN and auto-syn your electric calendar in minutes. Digital wall calendar compatible with Google calendar, iCloud calendar, Outlook calendar, Cozi calendar and Yahoo calendar. Add events directly on the device or through the ecalendar app. Electronic calendar stays current whether you're at work or traveling—no manual updates needed.
- All-In-One Home Assistant: Smart calendar builds habits and encourage independence with personalised chores. Display daily meal plan to reduce the daily ‘What's for dinner?’ stress. To-do lists keep track of everything you want. Turning chores into valuable achievements with stars and rewards, making life easier and more enjoyable.
- Manage Anytime Anywhere: BSIMB electronic calendar for family stay connected with the powerful ecalendar app. Access and manage your digital wall calendar anytime, anywhere with free features like stars & rewards, photo screensaver, chore charts, meals plans, to-do lists etc. Electronic planner paid features like Magic Import tailor advanced tools for users with special needs.
- Stay in Touch with Loved Ones: Share photos or videos from your phone to electronic wall calendar with app, instantly update your life moment, and keep in touch with your family, especially those who are far away; you can also surprise your smart calendar digital wall by sending him a wish card; it's also great for keeping tech-illiterate elders in touch with the youngsters.
The example uses proxy_read_timeout 75s;, providing operational margin over the documented defaults. If the application changes either heartbeat setting, calculate the new sum and set the NGINX timeout higher than it. Account for expected network idle periods as well; the value is not a replacement for Socket.IO’s heartbeat, it is the maximum period NGINX will wait for upstream data.
Keep this directive inside the Socket.IO location so unrelated HTTP routes retain their own timeout policy. After changing heartbeat or timeout settings, reload NGINX and reconnect existing clients to test the new behavior.
Serve Socket.IO over HTTPS
Terminate TLS in a normal NGINX server listening on port 443, then retain the same HTTP/1.1 and upgrade directives in the Socket.IO location. The browser should connect to the HTTPS origin; its WebSocket negotiation will then use the secure WebSocket scheme where applicable.
server {
listen 443 ssl;
server_name example.com;
ssl_certificate /etc/ssl/example.com/fullchain.pem;
ssl_certificate_key /etc/ssl/example.com/private.key;
location /socket.io/ {
proxy_pass http://127.0.0.1:3000;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}
}Use the certificate and key files issued for the actual host name. TLS termination does not remove the need for upgrade headers: NGINX still has to create the HTTP/1.1 tunnel from the TLS-facing proxy to Node.js. If the page is loaded over HTTPS, do not point the client at an insecure HTTP Socket.IO origin, because browser security rules can block that mixed-content connection.
Run Socket.IO on multiple Node.js processes
Define an NGINX upstream group when more than one Socket.IO process accepts connections:
upstream socketio_nodes {
server 127.0.0.1:3000;
server 127.0.0.1:3001;
}
server {
listen 80;
server_name example.com;
location /socket.io/ {
proxy_pass http://socketio_nodes;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection upgrade;
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_read_timeout 75s;
}
}Socket.IO documents session affinity for polling deployments because one logical session can issue successive HTTP requests. Those requests need to reach the same node unless the application’s Socket.IO adapter and session design explicitly support another arrangement. A WebSocket transport keeps one TCP connection for the session, so it does not make the same sequence of polling requests across workers.
Recommended Free Tools
Use address-based affinity
NGINX can select a consistent upstream using the client address:
upstream socketio_nodes {
hash $remote_addr consistent;
server 127.0.0.1:3000;
server 127.0.0.1:3001;
}ip_hash; is another documented option. The choice is an operational trade-off: address-based methods are simple but can concentrate users who appear behind the same NAT or intermediary. Test polling explicitly rather than assuming that a successful WebSocket connection proves multi-node polling is configured correctly.
Cookie-based stickiness
NGINX documentation identifies sticky-cookie support as requiring a commercial subscription. If cookie-based affinity is a requirement, evaluate the commercial NGINX feature or implement session routing at another layer; do not assume that the open configuration above provides cookie persistence.
Diagnose common failures
Polling works, but WebSocket upgrade fails
- Confirm the matching location contains
proxy_http_version 1.1. - Confirm both
UpgradeandConnectionheaders are set in that same location. - Check that a more specific or earlier location is not handling the request without those directives.
- Inspect the browser handshake and NGINX error log while reproducing the failure.
The client reports transport close after roughly a minute
- Compare the configured
proxy_read_timeoutwith the actual Socket.IOpingInterval + pingTimeout. - Remember that NGINX’s default is 60 seconds and Socket.IO’s documented default sum is 45 seconds; a custom heartbeat can make the default proxy value too short.
- Set a timeout with margin, reload NGINX, and reconnect the client.
The Socket.IO endpoint returns 404 or an unexpected application response
- Verify that the client, server, and NGINX location use the same path.
- Inspect whether
proxy_passincludes a URI suffix. A suffix replaces the portion matched by the location; omitting it forwards the original URI. - Check the Node.js log for the exact path received from NGINX.
The upstream is unreachable
- Verify that the Node.js service is running and listening on the configured port.
- Confirm the NGINX host can reach the upstream address;
127.0.0.1refers to the NGINX machine, not another server. - Run
nginx -tafter editing the upstream definition and inspect the error log for connection-refused or timeout messages.
Only some users disconnect in a multi-node deployment
- Determine whether those clients are using polling or WebSocket transport.
- Test with a single Node.js worker. If the problem disappears, add address affinity or another supported session-routing method.
- Temporarily force WebSocket transport in a controlled test to isolate polling affinity from upgrade and network problems.
HTTPS clients cannot connect
- Make sure the browser uses the HTTPS public origin and that the certificate matches the host name.
- Keep the upgrade directives in the TLS server’s Socket.IO location.
- Check for mixed-content blocking in browser developer tools before changing the upstream protocol.
Deployment checklist
- The public location exactly matches the Socket.IO client and server path.
proxy_http_version 1.1,Upgrade,Connection,Host, andX-Forwarded-Forare present in the location that receives Socket.IO traffic.proxy_passuses the intended URI form and does not rewrite the path accidentally.- The upstream address and port are reachable from the NGINX host.
- The proxy read timeout exceeds the configured Socket.IO heartbeat sum.
- For multiple nodes, polling has session affinity or the application provides an equivalent shared-session design.
nginx -tsucceeds before every reload, and the error log is monitored during the first connection test.- HTTPS server blocks contain valid certificate paths and preserve the same WebSocket proxy settings.
The Bottom Line
A dependable Socket.IO reverse proxy is mostly about exactness: match the path, preserve the URI, use HTTP/1.1, forward both upgrade headers, and set an idle timeout above the Socket.IO heartbeat interval. Add address affinity when polling is distributed across multiple Node.js workers.
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
