# Websocket: origin not allowed

**URL:** <https://forum.mattermost.com/t/websocket-origin-not-allowed/3097>\
**Category:** Troubleshooting\
**Created:** [March 29, 2017, 8:33am UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097 "2017-03-29T08:33:30Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![torsten](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/torsten/32/1201_2.png) [@torsten](https://forum.mattermost.com/u/torsten)\
**Post date:** [March 29, 2017, 8:33am UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097/1 "2017-03-29T08:33:30Z")

</div>

Server Windows 2012 R2  
Installed with this tut: [https://docs.mattermost.com/install/prod-windows-2012.html](https://docs.mattermost.com/install/prod-windows-2012.html)  
Mattermost Version 3.7.3  
Reversproxy is configured  
NO SSL is used.

#### Summary

[2017/03/29 10:19:56 CEST] [EROR] websocket connect err: websocket: origin not allowed  
[2017/03/29 10:19:56 CEST] [EROR] /api/v3/users/websocket:connect code=500 rid=zwgkfaegdbga8ms6c6g51wxjgo uid= ip=217.110.83.5 Failed to upgrade websocket connection [details:]

After update the Mattermost Server from 3.6 to the last version the error are filling the systemlog.  
The server runs but, sometimes the messages didn´t show up, only after a refresh.  
i googling the error but i didnt find the right solution. I hope that someone can help me.  
Thank You

---

<div class="post-metadata">

**Author:** ![jasonblais](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/jasonblais/32/720_2.png) [@jasonblais](https://forum.mattermost.com/u/jasonblais)\
**Post date:** [April 1, 2017, 4:46pm UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097/2 "2017-04-01T16:46:26Z")

</div>

Hey @torsten, thanks for the report,

We have a fix included in Mattermost v3.8 (released April 16th), which adds WebSocket CORS support and should resolve the issue you’re describing. The first release candidate is available on April 4th if you want to try it out.

We also recommend configuring reverse proxy with NGINX, not IIS – if you do set it up with IIS, ensure you’re using IIS 8.0 or later and have enabled WebSockets

---

<div class="post-metadata">

**Author:** ![coronin](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/coronin/32/700_2.png) [@coronin](https://forum.mattermost.com/u/coronin)\
**Post date:** [April 24, 2017, 1:41pm UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097/3 "2017-04-24T13:41:00Z")

</div>

I am visiting mattermost with multiple URLs. Since 3.8.0, SiteURL is required. Which should I put? Should I put it as in AllowCorsFrom “[http://abc.com](http://abc.com) [https://cde.com](https://cde.com)”

---

<div class="post-metadata">

**Author:** ![jasonblais](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/jasonblais/32/720_2.png) [@jasonblais](https://forum.mattermost.com/u/jasonblais)\
**Post date:** [April 24, 2017, 7:11pm UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097/4 "2017-04-24T19:11:36Z")

</div>

@coronin “[http://abc.com](http://abc.com) [https://cde.com](https://cde.com)” should work . Make sure to include a space in between the two urls

---

<div class="post-metadata">

**Author:** ![jasonblais](https://sea2.discourse-cdn.com/flex020/user_avatar/forum.mattermost.com/jasonblais/32/720_2.png) [@jasonblais](https://forum.mattermost.com/u/jasonblais)\
**Post date:** [April 24, 2017, 9:25pm UTC](https://forum.mattermost.com/t/websocket-origin-not-allowed/3097/5 "2017-04-24T21:25:47Z")

</div>

@coronin we just investigated and found out that `AllowCorsFrom` only supports a single domain name

We have a bug ticket to fix it here: [https://mattermost.atlassian.net/browse/PLT-6393](https://mattermost.atlassian.net/browse/PLT-6393)

Sorry about that, let us know if you’re hitting any issues with this bug…