Re: [hybi] Insight you need to know: Browsers are at fault when servers crash

[Willy Tarreau <[e-mail]>]

On Mon, Jul 26, 2010 at 02:45:44AM -0700, Maciej Stachowiak wrote:
> > You can also this this idea at the end
> > of an HTTP-like handshake to get started sending data without waiting
> > for the server to reply.
> 
> Doesn't this second design make WebSocket services potentially vulnerable to cross-protocol attacks from HTTP? It's easy for the HTTP attacker to make up a key and encrypt the attack payload with it, unless the server has to prove it understands WebSocket based on part of the handshake that the in-browser HTTP attacker can't control before it is allowed to process messages.

In my opinion, if the protocol relies on a real HTTP handshake, what
it will get from an attacker's browser will be a real HTTP request
that it will be able to proceed with. We must keep in mind that WS
servers will be exposed to the net, so while browser-based attacks
can be massive (and imply we should be able to protect against), it
does not mean that the server must end up in an unexpected state.

Also, from what I understood, on a normal browser, the attacker has
no control over the headers. If the key is sent in such headers, an
attacker should not be able to direct browsers at WS servers as those
ones will reject the request as invalid.

Regards,
Willy