Websockify with Token Target Selection
Published: 2021-08-24 17:27:16

---
title: Websockify with Token Target Selection
published: true
date: 2021-08-22 00:00:00 UTC
tags: 
canonical_url: https://datawookie.dev/blog/2021/08/websockify-with-token-target-selection/
---

![Websockify with Token Target Selection](https://datawookie.dev/blog/2021/08/websockify-with-token-target-selection/featured.jpg)

In a [previous post](../websockify-novnc-behind-an-nginx-proxy) I looked at how to set up Websockify behind an NGINX proxy. The ultimate goal was to accommodate multiple simultaneous users. Although the setup in that post _worked_, if the number of users is large then it becomes very resource hungry because there’s a Websockify instance running for each user.

We’re going to use [token based target selection](https://github.com/novnc/websockify/wiki/Token-based-target-selection) to implement the same setup but with just a single instance of Websockify. We’ll build a setup for two users, Alice and Bob, but the principles scale well to more users.

## VNC Servers

We need a separate VNC server for Alice and Bob.

Run this as user `alice`.

```
vncserver \
    -localhost no \
    -geometry 1024x768 \
    -SecurityTypes None --I-KNOW-THIS-IS-INSECURE \
    :0
```

Run this as user `bob`.

```
vncserver \
    -localhost no \
    -geometry 1024x768 \
    -SecurityTypes None --I-KNOW-THIS-IS-INSECURE \
    :1
```

We now have two VNC servers answering requests on ports 5900 and 5901.

## Websockify Token Configuration

Create a configuration file which specifies a token for each of the users.

```
U6F7msdQ: 127.0.0.1:5900
1oJw2DwG: 127.0.0.1:5901
```

The value of the token can be anything really. 🚨 The space following the first `:` is important!

## Websockify

Now we are ready to start Websockify.

```
websockify -D \
    --verbose \
    --web /usr/share/novnc/ \
    --token-plugin=TokenFile \
    --token-source=/etc/websockify-token.cfg \
    6080
```

Things to note:

- Don’t specify host and port for VNC.
- Use `--token-plugin` to specify the plugin for handling tokens. We’re using a token file plugin, `TokenFile`, but there are various other options like `ReadOnlyTokenFile` and `TokenRedis`.
- Use `--token-source` to specify the location of the configuration file. 🚨 Websockify doesn’t stop if it’s unable to open the configuration file. So, ensure that you are passing the correct _absolute_ path, otherwise things just won’t work and it won’t be apparent why!

## NGINX Proxy

The final component is to put all of this behind NGINX. First we need a simple HTML index page.

```
<a href="/novnc/vnc.html?resize=remote&path=novnc/websockify?token=U6F7msdQ">
  Alice
</a>
<a href="/novnc/vnc.html?resize=remote&path=novnc/websockify?token=1oJw2DwG">
  Bob
</a>
```

The key component here is the way that the path to Websockify is specified, passing the correct token for each of the users.

And a more concise `nginx.conf`, which now only needs to set up a proxy for a single instance of Websockify.

```
user www-data;
daemon off;

events {
}

http {
  server {
    listen 80 default_server;
    
    location / {
      root /www/data;
      try_files $uri $uri/ /index-both.html;
    }
    
    location /novnc/ {
      proxy_pass http://127.0.0.1:6080/;
    }
    location /novnc/websockify {
      proxy_pass http://127.0.0.1:6080/;
      proxy_http_version 1.1;
      proxy_set_header Upgrade $http_upgrade;
      proxy_set_header Connection "Upgrade";
      proxy_set_header Host $host;
    }
  }
}
```

Fire up NGINX.

```
nginx
```

And browse to the index page. Clicking through on either of the names takes you to the selected desktop. Notice that the token is passed through in the URL.

![](https://datawookie.dev/blog/2021/08/websockify-with-token-target-selection/desktop.png)

So now we have an appreciably leaner system: instead of a Websockify process for each user, we just have a single process which dispatches requests to the appropriate VNC service for each user.