Re: [hybi] hybi Digest, Vol 51, Issue 14

[Adam Rice <[e-mail]>]

On 12 June 2013 03:22, Scott Morgan <[e-mail]> wrote:

> Yes it would be easier to implement with a cookie, however it drives me
> nuts that cookies are usually used for additional location based
> authentication.   For instance, I use a few computers with 3+ user agents
> (ie browsers)  each to connect to my bank , and each browser on each
> computer needs to have it's cookie verified at a additional level, which
> creates extra work for users.
>

Personally I usually find the short session timeouts used by banks to be
more aggravating.

I'm not sure what you mean by "location based authentication". I don't want
someone to have access to my account just because they are standing behind
me.

If you want to put the session ID in a URL, I would recommend making it
>> single-use, although that means you need some mechanism to get a new
>> session ID if the WebSocket connection fails.
>>
>> RFC6455 allows WebSocket connections to use a different proxy than HTTPS
>> connections. Although I'm not aware of any client that actually implements
>> this, you should not assume that all requests from the same sender will
>> come from the same IP.
>>
> Could you be a little more specific as to where in RFC6455 it says this?
>

4.1.3:

       NOTE: Implementations that do not expose explicit UI for
       selecting a proxy for WebSocket connections separate from other
       proxies are encouraged to use a SOCKS5 [RFC1928
<http://tools.ietf.org/html/rfc1928>] proxy for
       WebSocket connections, if available, or failing that, to prefer
       the proxy configured for HTTPS connections over the proxy
       configured for HTTP connections.



> Also I understand you to mean something like;
> Johns FF Browser -> Proxy A https request -> Https/WS Server
> Proxy A dies, and Johns internet connection fails over to proxy B
> Johns FF Browser ->Proxy B ws request -> WS Server
> Is this what you meant?
>

No, I mean

Johns FF Browser -> Proxy A https request from 1.1.1.1 to HTTPS/WS Server
Johns FF Browser -> Proxy B ws request from 255.255.255.1 to HTTP/WS Server

The proxy is selected based on the protocol, so there is no need to Proxy A
to be dead for Proxy B to be used.

Of course, there are other circumstances where Johns FF Browser might
change IP address, for example when switching between mobile networks.

Thanks,
Adam