Qlik's WebSocket request error

[liuzhiwei]

Like before, if I wanted to establish a Qlik engine API connection, I could directly use const ws = new WebSocket("ws://192.168.111.63:8080/bi/app/?qlikTicket=3cc9ca3b-d36c-4ee6-ab3a-f225615ec5c6"), where the value after qlikTicket is the browser's cookie value. But now, if I write it this way, it throws the following error: failed: Error during WebSocket handshake: Unexpected response code: 403. I want to know the reason and the solution, thank you!

[Øystein_Kolsrud]

I don't know what versions you have moved between, but maybe you are missing the csrf-token that is now needed for websockets? https://community.qlik.com/t5/Official-Support-Articles/Qlik-Sense-Enterprise-on-Windows-Extended-We...

[liuzhiwei]

Hello, thank you for your reply. I looked at this article, and it says that the response headers need to be configured in the QMC virtual proxy. After configuring the response headers, how should my request parameters change? Do I need to append them when sending the request, or remove the ticket parameter? Could you take let testSocket = new WebSocket('wss://192.168.111.63/bi/?qlikTicket=a52e013e-1cb9-425a-b7b3-ab0c0031f5db'); as an example and give me a request address that I can access? Thank you, looking forward to your next reply.

[Øystein_Kolsrud]

Well, I think the information you need is in that page, but maybe it could be made more clear. Have a look at the "Workflow" section! There's a picture there that illustrates the flow.

The basic idea is that you need to request a csrf token from the Proxy service and use that when setting up the websocket. A similar flow also exists in the cloud solution.

So the flow is a two step process:

1. Call the REST endpoint qps/csrftoken:
   GET https://<url>/qps/csrftoken
2. Add the returned token as an argument to your websocket connection:
   Websocket request: wss://<url>/app?qlik-csrf-token=<token>

Reference documentation for the csrftoken endpoint can be found here:

https://help.qlik.com/en-US/sense-developer/November2025/apis/ProxyAPI/OpenAPI_Personal.generated.ht...

[liuzhiwei · Accepted solution]

You can still call it using the method I used before, you just need to configure the new parameters in the server request response header, I found this after a long trial.