Re: [hybi] WebSocket handshake (HTTP and SSO)

[Greg Wilkins <[e-mail]>]

On 2 September 2010 09:41, Joe Hildebrand <[e-mail]> wrote:
> On 9/1/10 5:30 PM, "Greg Wilkins" <[e-mail]> wrote:
>
>> Sec-WebSocket-Key1: the ietf process failed 12345678
>
> It's too early to declare that, I hope.
>
> Let's start by understanding the requirement.  Gabriel, it looks like we
> don't have anything that addresses the rationale behind this handshaking
> approach in the requirements draft -- do you concur?

Joe,

as Adam pointed out, I think we do have consensus on the general
requirement - ie that we should protect against cross protocol
attacks.
While I don't think everybody agreed about the possibility of an
injection attack, I think there were very few who did not accept that
a nonce was a good idea.

It is just that when the nonce was added to the draft, it came with a
unilaterally invented non discussed encoding of random characters and
spaces.  It was also used as part of a fast fail attempt that has
further confused the issue.
I agree with John that this is not a huge technical issue, but I think
the strangeness of the encoding causes confusion, clouds the real
issue and is a potential ongoing cause of misunderstandings.

Anyway, I've used up my message quota on this issue, so I'll let it
go.  I think the process failed letting this get into an ietf WG draft
in the first place, but it wont be the end of the world if it stays
in.

cheers