joaorb64 / joaorb64/TournamentStreamHelper

Scoreboard breaks when accessed via HTTPS reverse proxy (mixed content — hardcoded ws:// and http://)

Open
#994 2 comments 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
139
Forks
59
Avg merge
2d 9h
Merged PRs (30d)
6

Description

I run TSH behind a Cloudflare Tunnel so I can control scoreboards remotely at events (from a tablet or phone on a different network). When accessing the scoreboard page via the tunnel (https://), two things break:

  1. The Socket.IO connection never establishes — the page sticks on "Loading"
  2. Even after fixing #1, all interactive features do nothing — scores don't submit, bracket doesn't load, player data doesn't update

Affects all browsers (Chrome, Safari) — it's a protocol issue, not browser-specific.

Root cause:

The scoreboard frontend hardcodes ws:// and http:// regardless of what protocol the page was loaded over. When the page is served via HTTPS, the browser enforces Mixed Content security rules and silently blocks both:

  • The ws:// WebSocket connection
  • Every fetch("http://...") call in the app

Affected source files and endpoints:

  • stage_strike_app/src/websocketConnection.t://)
  • stage_strike_app/src/ScoreboardPage/Score.jsx — submitScore (/score), submitSetInfo (/scoreboardN-set?)
  • stage_strike_app/src/ScoreboardPage/Team.j/scoreboardN-set?,/scoreboardN-update-team-*)
  • Clear Scoreboard button — /scoreboardN-cle
  • Swap Teams button — /scoreboardN-swap-teams
  • Get Sets — /get-sets (Start.gg bracket pul
  • Load Set — /scoreboard1-load-set
  • Stage Strike RPS — /stage_strike_rps_win
  • Player autocomplete — /states?countryCode=
  • Countries data — /assets/data_countries.js

Suggested fix:

Check window.location.protocol at runtime anon HTTPS, omitting the port (the reverseproxy handles routing). Fall back to ws:// / http:// with the port on plain HTTP (LAN access).

For the WebSocket:
const wsUrl = window.location.protocol === "
? wss://${window.location.hostname}/
: `ws://${window.location.hostname}:${BACK
this._instance = io(wsUrl, { ... });

For all fetch calls — replace:
fetch(http://${window.location.hostname}:${ With: const base = window.location.protocol === "h ? https://${window.location.hostname}:http://${window.location.hostname}:${BA
fetch(${base}/endpoint)

A shared helper function for the base URL would clean this up across all components.

Why this matters:

Tournament operators running multi-table setups often need remote scoreboard access from phones or tablets that aren't on the same LAN. A Cloudflare Tunnel (or anyer HTTPS) is a natural and common solution,but it's completely blocked by the current hardcoded protocols. This fix would make TSH fully functional in those setups — including bracket loading from Starand all scoreboard controls — withoutrequiring manual edits to compiled output files after every update.

Contributor guide

No contributing guide indexed for this repository

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start by inspecting stage_strike_app/src/websocketConnection.t and the fetch calls in stage_strike_app/src/ScoreboardPage/Score.jsx and Team.j. Trace the listed scoreboard, player, country, and bracket endpoints, then verify that WebSocket and fetch connections work through HTTPS while preserving plain-HTTP LAN access.

Written by the indexing model from the issue text.

Assessment

Tech stack
javascript
Domain
frontend, networking, web-dev
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.