Re: 6455 Websockets and the relationship to HTTP

Jacob Champion <> Fri, 02 December 2016 17:40 UTC

Return-Path: <>
Received: from localhost (localhost []) by (Postfix) with ESMTP id F33301296E4 for <>; Fri, 2 Dec 2016 09:40:06 -0800 (PST)
X-Virus-Scanned: amavisd-new at
X-Spam-Flag: NO
X-Spam-Score: -9.897
X-Spam-Status: No, score=-9.897 tagged_above=-999 required=5 tests=[BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, HEADER_FROM_DIFFERENT_DOMAINS=0.001, RCVD_IN_DNSWL_HI=-5, RP_MATCHES_RCVD=-2.896, SPF_HELO_PASS=-0.001, SPF_PASS=-0.001] autolearn=ham autolearn_force=no
Authentication-Results: (amavisd-new); dkim=pass (2048-bit key)
Received: from ([]) by localhost ( []) (amavisd-new, port 10024) with ESMTP id dKYouT9bfrkK for <>; Fri, 2 Dec 2016 09:40:05 -0800 (PST)
Received: from ( []) (using TLSv1.2 with cipher DHE-RSA-AES128-SHA (128/128 bits)) (No client certificate requested) by (Postfix) with ESMTPS id 9F9B5129673 for <>; Fri, 2 Dec 2016 09:40:05 -0800 (PST)
Received: from lists by with local (Exim 4.80) (envelope-from <>) id 1cCrm1-000801-M9 for; Fri, 02 Dec 2016 17:37:25 +0000
Resent-Date: Fri, 02 Dec 2016 17:37:25 +0000
Resent-Message-Id: <>
Received: from ([]) by with esmtps (TLS1.2:RSA_AES_128_CBC_SHA1:128) (Exim 4.80) (envelope-from <>) id 1cCrlu-0007xU-0c for; Fri, 02 Dec 2016 17:37:18 +0000
Received: from ([]) by with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.84_2) (envelope-from <>) id 1cCrln-0004ky-Li for; Fri, 02 Dec 2016 17:37:12 +0000
Received: by with SMTP id 3so109634215pgd.0 for <>; Fri, 02 Dec 2016 09:36:50 -0800 (PST)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20120113; h=subject:to:references:from:message-id:date:user-agent:mime-version :in-reply-to:content-transfer-encoding; bh=PpEAoss+0eLfFF1px457+MkegRqkHjsohfEt+eKG2T0=; b=kiB6uvPw+PWhkpx1KVOM57HnE0QS+NNsk//INObfKk28kZeMdAC50WHMpwDbQWDxxE Mpw+oTV0Ir3sFuEF57GMWqRQV+PDi1+FI6iLQtslpSuohRytqPt6BCPlr//Cdo5JDv2G epE/5XfB2iH5JD+MNqM9dJ4HkQTaaM+AQMxkCcq3cGl4DpfzTeuL3e406wBj7VuxMbj/ BFyb7HKPygdk4nE6Uc+a/GctH+LrsaUBGg2Zk1tCZ5gkj+va1Xm7+96qbGwCS4ObrwE6 DdDKU9vnJZBXiGnzhbIpP2pWkUQMdDF5pl4OsQR/Tme1AOiCBNdhVbRzvmuN8yys6Eds dcAw==
X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed;; s=20130820; h=x-gm-message-state:subject:to:references:from:message-id:date :user-agent:mime-version:in-reply-to:content-transfer-encoding; bh=PpEAoss+0eLfFF1px457+MkegRqkHjsohfEt+eKG2T0=; b=UAXiEvWU7x+7DXoMT3we3I4UwTwZWnr4ZhZHGbXVrxgSAdAxNAVoELPKUd25MkVfHb Ye8fc9gd8YCYZ4DberhEMihAnZuef+w80NudltZa7z6Nck8D6OCV8qjAvS+mAcRNOthG E1VTZup/Vq25MT1ffJCkIkRRL0TnIDH+gJaMqdbCGFTOJmB9Jx6t7mpAUX+Klu9lDrQ8 X1swmFflv6J8hbV9PDw81xJqJ5eYz7jkL4ghoH43n3b8habsUUYiFZ8M1y4qhXCkMr/B XoaTFRzmGmMOiSPnffTQyrX0lpbZgWQ5KUwTyD7RGPq5vtrrbDUfNCP7FBbPjKj8V1hY TLQA==
X-Gm-Message-State: AKaTC00dbxs4q6rr5UQCWA3F98KKgKRjg9s6wC1qq1GHHBbE8dSBghQvWsEbssL5l9RYgw==
X-Received: by with SMTP id h64mr79874992pge.135.1480700199803; Fri, 02 Dec 2016 09:36:39 -0800 (PST)
Received: from [] ( []) by with ESMTPSA id a22sm9292271pfg.7.2016. for <> (version=TLS1_2 cipher=ECDHE-RSA-AES128-GCM-SHA256 bits=128/128); Fri, 02 Dec 2016 09:36:39 -0800 (PST)
References: <> <> <> <> <> <> <> <> <> <> <>
From: Jacob Champion <>
Message-ID: <>
Date: Fri, 02 Dec 2016 09:36:38 -0800
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:45.0) Gecko/20100101 Thunderbird/45.5.1
MIME-Version: 1.0
In-Reply-To: <>
Content-Type: text/plain; charset="utf-8"; format="flowed"
Content-Transfer-Encoding: 8bit
Received-SPF: pass client-ip=;;
X-W3C-Hub-Spam-Status: No, score=-4.0
X-W3C-Hub-Spam-Report: BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, FREEMAIL_FROM=0.001, RCVD_IN_DNSWL_NONE=-0.0001, RCVD_IN_MSPIKE_H3=-0.01, RCVD_IN_MSPIKE_WL=-0.01, SPF_PASS=-0.001, W3C_AA=-1, W3C_WL=-1
X-W3C-Scan-Sig: 1cCrln-0004ky-Li 4d1fd4303caab04f4771085959965944
Subject: Re: 6455 Websockets and the relationship to HTTP
Archived-At: <>
X-Mailing-List: <> archive/latest/33090
Precedence: list
List-Id: <>
List-Help: <>
List-Post: <>
List-Unsubscribe: <>

On 12/02/2016 03:33 AM, Cory Benfield wrote:
> I assume that what you mean here is you can’t deploy a H2 *only*
> server that also does WS: that is, a server with no HTTP/1.1 stack.
> To which I reply: so what? Last I looked no-one was deploying servers
> that can *only* do HTTP/2 except in very specific cases where they
> are deliberately seeing the HTTP/2 use-cases (the only two instances
> I know of are Apple’s new Push Notification Service and Amazon’s
> Alexa API, both of which are HTTP/2 only: presumably they considered
> and rejected the use of WS, and it didn’t stop them shipping their
> product).
> I don’t think anyone is planning to move to a HTTP/2-only server
> stack anytime soon, and we have a whole bunch of servers that have
> mature and battle-tested HTTP/1.1 stacks that aren’t going anywhere.
> So I’m not really convinced that there’s any demand for H2-only + WS.
> Of course, I might be wrong (I’m wrong a lot).

I think this ends up being a circular argument. If people rely on both 
HTTP/2 and WS, but WS requires HTTP/1.1, then they will not demand an 
HTTP/2-only stack. Likewise with the Amazon and Apple examples: they're 
going to ship what works; it doesn't necessarily mean the engineers 
didn't want something different. (Perhaps there are employees watching 
the list who can chime in?)

This is not a server-only thing, either. A conforming WebSocket client 
has to implement enough of HTTP/1.1 to handle, or at least correctly 
bail out from, any pre-upgrade shenanigans such as 3xx redirects, 401 
authentications, Set-Cookies, etc.

(For the record, my background is primarily in the embedded security 
space, where opportunities to consolidate and reduce software footprint 
-- and attack surface -- are pretty much always welcomed.)