Event endpoint: clear HTTP response instead of misleading 502 without WebSocket upgrade #168

Open
opened 2026-10-29 20:17:28 +00:00 by chatgpt · 0 comments
Member

A normal HTTP GET/HEAD to https://events.oss-oo.io/ currently returns an empty 502. This is misleading for people and generic HTTP monitors visiting the event endpoint.

The protocol-correct check on 2026-10-29 20:14 UTC passed: trusted TLS, WebSocket upgrade on /mqtt (101), and authenticated MQTT 3.1.1 CONNACK 0 followed by disconnect. No event was published or subscribed to during that check. The plain HTTP observation alone is therefore not evidence of a broker outage; this check also does not prove ongoing event delivery.

Later polish, explicitly requested by the owner:

  • Return an intentional, concise response for ordinary HTTP requests, explaining that this is an authenticated MQTT-over-WebSocket endpoint and linking to the public event contract. Choose the exact response/status as part of implementation.
  • Preserve the actual WebSocket upgrade route, authentication and subscription ACLs.
  • Keep monitoring tied to the authenticated protocol handshake; an informative HTTP response must not turn a broken broker into a healthy check.
  • Validate ordinary GET/HEAD, valid WebSocket/MQTT CONNECT, rejected authentication, and broker-unavailable behavior separately.

This is a deferred clarity/diagnostics improvement. No service, DNS or monitoring change was made for this report.

A normal HTTP GET/HEAD to `https://events.oss-oo.io/` currently returns an empty 502. This is misleading for people and generic HTTP monitors visiting the event endpoint. The protocol-correct check on 2026-10-29 20:14 UTC passed: trusted TLS, WebSocket upgrade on `/mqtt` (101), and authenticated MQTT 3.1.1 CONNACK 0 followed by disconnect. No event was published or subscribed to during that check. The plain HTTP observation alone is therefore not evidence of a broker outage; this check also does not prove ongoing event delivery. Later polish, explicitly requested by the owner: - Return an intentional, concise response for ordinary HTTP requests, explaining that this is an authenticated MQTT-over-WebSocket endpoint and linking to the public event contract. Choose the exact response/status as part of implementation. - Preserve the actual WebSocket upgrade route, authentication and subscription ACLs. - Keep monitoring tied to the authenticated protocol handshake; an informative HTTP response must not turn a broken broker into a healthy check. - Validate ordinary GET/HEAD, valid WebSocket/MQTT CONNECT, rejected authentication, and broker-unavailable behavior separately. This is a deferred clarity/diagnostics improvement. No service, DNS or monitoring change was made for this report.
Sign in to join this conversation.
No labels
No milestone
No project
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set

Reference
OSS-OO/laboratory#168
No description provided.