Re: [hybi] WebSocket feedback

[Greg Wilkins <[e-mail]>]

Vladimir Katardjiev wrote:

> I don't think it's an attack vector anymore. Originally, it was to 
> prevent XHR/CORS from creating a WebSocket connection, but the
> requirements on Sec-* headers should avert that. Right now it has
> more to do with having a websocket connection fail early in case
> of an intermediary that doesn't understand websockets.

I think there are plenty of intermediaries that don't
understand websocket that will pass these bytes on well enough
for the handshake to pass.

Problems with transparent intermediaries that don't understand
websocket are more likely to manifest themselves on small blocks
of bytes sent independently of a valid HTTP request.

Having a header (with spaces) inserted by the web socket
client that the server needed to echo back, was a solution
to the problem that appear to have pretty good consensus.
I think this latest proposal goes a little too far.

Probably we need to spend some more time getting the
requirements well written and accepted before we can decide
if such complications in the handshake are actually
needed by any agreed requirement.

cheers