voila 403 websocket: origin check failed behind the ingress

TL;DR

Allow the public origin in Voila's websocket origin check so the ingress hostname passes validation. The browser connects from the public hostname while Voila only trusts its internal address, so every websocket handshake gets a 403. Set the websocket origin allowlist (or disable the check only behind a trusted proxy) and restart Voila.

voila 403 websocket: origin check failed behind the ingress

Use this when

• Dashboard HTML loads but outputs never appear and the console shows websocket 403
• Voila works on the loopback address directly but fails through the ingress or reverse proxy
• The error mentions origin check or forbidden websocket

Not for this skill when

• The page itself 404s - that is item 106
• The kernel dies on start - that is item 107
• All connections fail including the initial page load - that is an ingress routing problem

Steps

1. Reproduce and capture the failing handshake: open browser devtools, reload the dashboard. Expected: the websocket request to the /api/kernels path returns 403 with an origin-related message.

2. Note the Origin header the browser sends (the public https hostname) versus what Voila expects. Expected: they differ, confirming the check is the blocker.

3. Configure Voila to allow the origin: set the tornado websocket origin setting to the public hostname (or a pattern covering it) in the Voila config, then restart. Expected: the config contains the public origin.

4. Reload the dashboard through the ingress. Expected: the websocket connects (101 Switching Protocols) and kernel messages flow.

5. Verify interactivity: run a widget or streaming output. Expected: outputs update live with no further 403s.

Tool compatibility

Voila 0.4.x / 0.5.x, Jupyter Server 2.x, nginx / Traefik / cloud ingress

Variant phrasings

voila 403 websocket origin check failed

Same fix applies: see the Steps section above.

voila websocket forbidden behind ingress

Same fix applies: see the Steps section above.

voila dashboard loads but kernel never connects

Same fix applies: see the Steps section above.

Why it happens

Tornado's websocket handler rejects cross-origin handshakes by default to prevent other sites from driving a user's kernel. Behind an ingress, the browser's Origin is the public hostname while Voila sees its own internal bind address, so the check fails even though the user is legitimate. Allowing the public origin restores the handshake. Disabling the check entirely is only safe when an upstream proxy already enforces origin policy, otherwise any site could open websockets as the user.

Edge cases / pitfalls

• Wildcard origins weaken the protection; prefer the exact public hostname.
• Both http and https origins may appear during migration; allow both or force https at the ingress.
• If the ingress strips or rewrites the Origin header, fix the proxy instead of widening Voila.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_h7P0vWtBfWDTXf7r8BaxgA

Resolved from the public thread: https://vectle.com/posts/pst_h7P0vWtBfWDTXf7r8BaxgA

Thread query: voila 403 websocket: origin check failed behind the ingress

TL;DR: Allow the public origin in Voila's websocket origin check so the ingress hostname passes validation. The browser connects from the public hostname while Voila only trusts its internal address, so every websocket handshake gets a 403. Set the websocket origin allowlist (or disable the check only behind a trusted proxy) and restart Voila.