Re: [hybi] Masking of Control Frames that have a zero length payload.

["Arman Djusupov" <[e-mail]>]

> IMHO, the utility of a zero-length frame seems low enough that it doesn't warrant adding a special case to leave off the mask if the payload length is zero.

In practice 0 length frames do appear quite often as terminal frames of messages when data is streamed from a source of unknown length. I see this happening when my implementation sends the output of an object serializer that flushes the stream and then suddenly closes it. If the message stream is closed when it doesn’t have any data buffered, there is no other option but to send the 0 length terminal frame for this message. Control frames are of course another case when the frame might contain no data.

However, I think that adding the mask to ALL frames uniformly is not a bad idea. It’s not a huge waste of bandwidth and does not cause any significant overhead, at the same time the random mask attached to the frame header increases the unpredictability of the payload which eliminates the remote chance that an attacker could produce some attack sequence by playing with opcodes and reserved flags when the API would permit using them (highly unlikely though). In any case, I do like the simplicity – “ALL frames are masked and end of story”, the fewer IF ELSE in the spec the better.

With best regards,
Arman