Re: [hybi] WebSocket handshake (HTTP and SSO)

[Greg Wilkins <[e-mail]>]

2010/9/4 Benjamin Black <[e-mail]>:
> I actually removed a sentence saying approximately "I don't see how
> this matters to anyone but Google", but thought it too snarky.  Next
> time I'll know!

I've been implementing comet solutions for applications with several
orders of magnitude less users than google.

Initial start up time definitely does matter.

For example, if the websocket transport is left on, then the RTT taken
to try, fail and then fall back to normal comet is very noticeable.
Specially if it combines with RTTs for cross domain preflight
requests.

> My suggestion?  Use existing HTTP auth, since that is easier for
> everyone else.  Implement alternative schemes in Chrome and for your
> apps (the client side will know to use the Google auth mechanism, and
> its use will tell the server what is going on).

My suggestion is that this WG should not be trying to pick winners in
the game of Authentication. We should support all commonly deployed
authentication mechanisms and anticipate future support of all
reasonably conceived possible authentication mechanisms.

cheers