我自己解决了这个问题。基本上，如果你想使用WebSocket和Spring Security，Nginx需要传递一些额外的头值。下面几行需要添加到你的Nginx配置中的location部分：

# Pass the csrf token (see https://de.wikipedia.org/wiki/Cross-Site-Request-Forgery)
    # Default in Spring Boot and required. Without it nginx suppresses the value
    proxy_pass_header X-XSRF-TOKEN;

    # Set origin to the real instance, otherwise a of Spring security check will fail
    # Same value as defined in proxy_pass
    proxy_set_header Origin "http://testsysten:8080";

虽然我使用的是非常经典的HTTPS配置，但公认的解决方案对我不起作用：

server {
    listen 443 ssl;
    location /ws {
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $http_host;
        proxy_pass http://127.0.0.1:8888;
    }
...

问题是Spring检查源代码，特别是给我带来麻烦的代码：

// in org.springframework.web.util.UriComponentsBuilder.adaptFromForwardedHeaders(HttpHeaders):
        if ((this.scheme.equals("http") && "80".equals(this.port)) ||
                (this.scheme.equals("https") && "443".equals(this.port))) {
            this.port = null;
        }

在该代码中，方案是“http”，端口是8888，由于它不是标准端口，因此未被丢弃。
但是浏览器点击https://myserver/，443端口被忽略，因为它是默认的HTTPS端口。
因此，端口不匹配（空！= 8888），并且来源检查失败。
您可以在Spring WebSockets中禁用来源检查：

registry.addHandler( resgisterHandler(), "/ws" ).setAllowedOrigins( "*" );

或者（可能更安全）您可以将方案和端口添加到NGINX代理配置中：

proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Port $server_port;

如果您感兴趣，可以读取这些标题

org.springframework.web.util.UriComponentsBuilder.adaptFromForwardedHeaders(HttpHeaders)

适用于 Spring Boot 2.2.2+

从Sping Boot 版本2.2.2开始，您应添加以下设置，以便考虑这些X-Forwarded-*标头：

server.forward-headers-strategy=native

(in例如application.properties）

我也遇到过类似的问题，我无法在NGINX上使用基本的Spring Security身份验证，除了设置proxy_pass_header X-XSRF-TOKEN;之外，我还必须设置underscores_in_headers on;，因为NGINX默认不允许头标带有下划线，CSRF令牌名为_csrf。
我的最终配置文件如下所示：

server {
    underscores_in_headers on;
    listen 80 default_server;
    listen [::]:80 default_server ipv6only=on;

    root /usr/share/nginx/html;
    index index.html index.htm;

    # Make site accessible from http://localhost/
    server_name localhost;

    location / {
            # First attempt to serve request as file, then
            # as directory, then fall back to displaying a 404.
            try_files $uri $uri/ =404;
            # Uncomment to enable naxsi on this location
            # include /etc/nginx/naxsi.rules
    }
    location /example/ {
            proxy_pass_header X-XSRF-TOKEN;
            proxy_pass      http://localhost:8080/;
    }
}

我在NGINX代理中没有CSRF报头的情况下解决了这个问题。
我的堆栈：spring-boot，spring-security（带有redis会话存储），spring-boot-WebSocket with default STOMP implementation，NGINX服务于前端并代理到前端使用的另一个服务。
在我第一次使用default configuration show in the NGINX Blog here和这里（复制和粘贴历史）：

http {
    map $http_upgrade $connection_upgrade {
        default upgrade;
        '' close;
    }

    upstream websocket {
        server 192.168.100.10:8010;
    }

    server {
        listen 8020;
        location / {
            proxy_pass http://websocket;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
        }
    }
}

但不工作，仍然403禁止。
我用下面的配置修复了这个问题（修复WebSocket真实的重要的部分是 *# WebSocket代理 *）：

worker_processes  1;

events {
    worker_connections  1024;
}

http {

    include       mime.types;
    default_type  application/octet-stream;
    sendfile        on;
    keepalive_timeout  65;

    server {
        listen       30010;
        server_name  localhost;
        client_max_body_size 10M;

        location / {
            root   /usr/share/nginx/html;
            index  index.html index.htm;
        }

        # Backend API Proxy
        location /api {
            proxy_pass http://192.168.0.100:30080;
            proxy_set_header Host $http_host;
            proxy_set_header Access-Control-Allow-Origin 192.168.0.100;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-NginX-Proxy true;
            rewrite ^/api/?(.*) /$1 break;
            proxy_redirect off;
        }

        # CDN Proxy
        location ~ ^/cdn/(.*) {
            proxy_pass http://192.168.0.110:9000;
            rewrite ^/cdn/(.*) /$1 break;
        }

        # This is the configuration that fix the problem with WebSocket
        # WebSocket Proxy
        location /ws {
            proxy_pass http://192.168.0.120:30090;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
            proxy_set_header Host $http_host;
            proxy_set_header Access-Control-Allow-Origin 192.168.0.120;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-NginX-Proxy true;
        }

    }

}

在我的例子中（Sping Boot 应用程序），除了按照接受的答案中指定的那样设置Origin头之外，我还必须设置Host头以匹配Origin头的ip：port，或者完全去掉它。
这是我的工作vhost配置：

server {
        listen 443 ssl;
        listen [::]:443 ssl;

        ssl_certificate /etc/ssl/certs/<your-cert-file>.pem;
        ssl_certificate_key /etc/ssl/private/<your-key-file>.key;

        server_name <your-server-fqdn>;

        access_log /var/log/nginx/<your-server-fqdn>.access.log;
        error_log /var/log/nginx/<your-server-fqdn>.error.log error;

        root /srv/www/<your-server-fqdn>;
        index index.html index.html;

        location / {
                try_files $uri $uri/ /index.html;
        }

        location /api {
                proxy_pass http://127.0.0.1:8080/v1;
        }

        location /async-api {
                proxy_pass http://127.0.0.1:8080/stomp;

                proxy_http_version 1.1;

                # either set Host header as follows or get rid of the directive altogether  
                #proxy_set_header Host "127.0.0.1:8080";

                proxy_set_header Upgrade $http_upgrade;
                proxy_set_header Connection "Upgrade";

                # Set origin to the real instance, otherwise a of Spring security check will fail
                # Same value as defined in proxy_pass
                proxy_set_header Origin "http://127.0.0.1:8080";

                proxy_set_header X-Forwarded-Host $host:$server_port;
                proxy_set_header X-Forwarded-Server $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }

        location /admin-api {
                proxy_pass http://127.0.0.1:8080/api;
        }
}