Re: [hybi] workability (or otherwise) of HTTP upgrade

["Pat McManus @Mozilla" <[e-mail]>]

On Thu, 2010-12-09 at 14:30 +1100, Mark Nottingham wrote:

> 
> I still haven't seen anyone explain why CONNECT is better than, say,
> WEBSOCKET_PLEASE.

I think WEBSOCKET_PLEASE and GET/POST+Upgrade share a concern that an
implementation will have to deal with them in a path dedicated to
"things I don't understand". A reasonable path for a proxy is to just
forward it on as if it were any other message - and we haven't broken
the message parsing rules so this will appear to work just fine. It is a
pragmatic concern, not one based strictly on the specification.

WEBSOCKET_PLEASE feels a bit better in that an unknown method is a
stronger bit of breakage than an unknown header, but I'm not comfortable
with it.

CONNECT is different in that it is more reasonable to assume it doesn't
show up in the proxy list of "things I don't understand". If nothing
else has made them aware viruses have done so. A new method will of
course be unknown, and Upgrade has almost no visibility on the net so it
too might be unknown - but CONNECT is much closer to the core services
and dates back a lot longer than Upgrade. We aren't relying on the
handling of CONNECT being unknown, at least as a first line of defense.

If we going with a port/80/http handshake I still support the "CONNECT
to invalid" approach. I haven't seen anything to suggest real problems
with it and there is evidence to believe it will work.

That being said, I've always preferred that WebSockets not be HTTP/80
based at all - but the group had really reached consensus on that topic
and I believe in working forward within that consensus. I think the
minutes say the "focus will be on leveraging HTTP infrastructure" while
noting that it doesn't actually preclude the group from looking at other
alternatives - but I read the clear sense of the group as wanting to
base WebSockets on the one-true-port.

I am in favor of revisiting the non HTTP approach, but I don't think
there will be agreement on it. And lacking agreement, I think CONNECT is
workable and a way forward to make some progress.

-Patrick

-- 
http://www.getfirefox.com/