Skip to content

Websocket: Fix connection failing without system CA certificates or IPv6 support - #369

Open
iLLiCiTiT wants to merge 1 commit into
developfrom
bugfix/websocket-ssl-and-ipv6
Open

iLLiCiTiT wants to merge 1 commit into
developfrom
bugfix/websocket-ssl-and-ipv6

Conversation

@iLLiCiTiT

Copy link
Copy Markdown
Member

Changelog Description

Websocket connections to the AYON server now work in pythons that have no system CA certificates or no IPv6 support. Flame on macOS hits both. Before this change, REST requests worked there but the websocket connection always failed.

Additional info

Ports the client changes from ynput/ayon-core#2241 and ynput/ayon-core#2243 into ServerAPI.create_websocket and EventHub.

  • SSL (Tools: Fix connection lost overlay when websocket SSL verification fails ayon-core#2241): when SSL verification is enabled and no CA file is set, create_websocket now passes the requests CA bundle to websocket. It checks REQUESTS_CA_BUNDLE, then CURL_CA_BUNDLE, then falls back to certifi. A directory is passed as ca_cert_path. Before, websocket-client fell back to the ssl default certificates, and a python.org build on macOS has none, so every wss:// connection failed with CERTIFICATE_VERIFY_FAILED.
  • IPv6 (Tools: Fix connection lost overlay in python without IPv6 support ayon-core#2243): when socket.has_ipv6 is False, IPv6 addresses are filtered out of websocket's address resolution. This wraps the private websocket._http._get_addrinfo_list and is applied only once. Before, localhost resolved to ::1 first and websocket failed with connect(): bad family instead of trying IPv4.
  • Logging: EventHub logs the first websocket connection failure as a warning, including the exception. Before, every exception in the loop was swallowed silently.

Testing notes:

  1. Run Flame 2026 on macOS against an AYON server, both https://... and http://localhost:<port>.
  2. Create an EventHub (or open AYON tools) and check that the websocket connects (connection.opened is emitted).
  3. Stop the server: a single "Lost connection to AYON server websocket" warning is logged, not one per reconnection attempt.

Websocket now verifies SSL with the same CA bundle as 'requests', skips
IPv6 addresses when python has no IPv6 support, and the event hub logs
the first connection failure.

Ported from ynput/ayon-core#2241 and ynput/ayon-core#2243.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

This branch has not been deployed

No deployments
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant