Re: [hybi] WebSocket handshake (HTTP and SSO)

[Adam Barth <[e-mail]>]

On Wed, Sep 1, 2010 at 4:41 PM, Joe Hildebrand <[e-mail]> wrote:
> On 9/1/10 5:30 PM, "Greg Wilkins" <[e-mail]> wrote:
>> Sec-WebSocket-Key1: the ietf process failed 12345678
>
> It's too early to declare that, I hope.
>
> Let's start by understanding the requirement.  Gabriel, it looks like we
> don't have anything that addresses the rationale behind this handshaking
> approach in the requirements draft -- do you concur?
>
> Assuming that my quick skim of draft-ietf-hybi-websocket-requirements-01
> didn't miss anything, can someone propose language for the requirements
> draft that adequately captures what we're trying to protect against?

I believe this text in the requirements draft is sufficient:

[[
   REQ. 19:  WebSocket should be designed to be robust against cross-
      protocol attacks.  The protocol design should consider and
      mitigate the risk presented by WebSocket clients to existing
      servers (including HTTP servers).  It should also consider and
      mitigate the risk to WebSocket servers presented by clients for
      other protocols (including HTTP).

   Reason: As the Web Socket protocol is expected to be mainly used in
   browsers, a careful design is necessary to mitigate the chances for
   hostile JavaScript to use WebSocket for a cross-protocol attack
   against vanilla HTTP resources or non-HTTP servers.  More the design
   should prevent the possibility for cross-site XMLHttpRequest (using
   CORS or XDomainRequest) to be used for a cross-protocol attack
   against WebSocket resources, potentially violating integrity (though
   not confidentiality).
]]

Adam