Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Willy Tarreau <[e-mail]>]

On Wed, Sep 07, 2011 at 09:14:52AM +0200, Sylvain Hellegouarch wrote:
> Since the masking and unmasking are the same operations, I fail to
> understand the added complexity of server-to-client masking. Clients already
> know how to unmask since they can mask in the first place with the same
> operation.

Except they don't know the masking key. The purpose of masking is not
to prevent a *client* from emitting the data it wants, but to prevent
some *javascript code* running in a browser from doing so. The client
is not the issue here, the issue is the fact that the attacker on the
server side might easily make a client execute some controlled JS code.
We want to ensure that someone who's present at both ends cannot easily
control the byte stream sent by the client. And since the JS does not
know the key, there's no easy way to perform the operation backwards
first.

Regards,
Willy