[hybi] Question about Sec-WebSocket-Accept paragraph

[Joel Martin <[e-mail]>]

Sorry for the bogus subject in the previous post.

On Thu, Jun 16, 2011 at 10:54 AM, Joel Martin <[e-mail]> wrote:

> I started to try and answer this StackOverflow question about the protocol
> text and realized that I didn't understand it as well as I thought:
>
> http://stackoverflow.com/questions/6372252/why-does-the-server-in-a-websocket-request-have-to-answer-a-challenge
>
> The question is related to this paragraph (which has been in the drafts for
> a while unchanged):
>
>     Finally, the server has to prove to the client that it received the
>     client's WebSocket handshake, so that the server doesn't accept
>     connections that are not WebSocket connections.  This prevents an
>     attacker from tricking a WebSocket server by sending it carefully-
>     crafted packets using |XMLHttpRequest| or a |form| submission.
>
> I can see how the Sec-WebSocket-Accept would prevent a WebSocket client
> from being tricked into connecting to a non-WebSocket server. However, I'm
> having difficulty understanding how the Sec-WebSocket-Accept header would
> prevent a XMLHttpRequest from succeeding to a WebSockets server since it is
> sent from the server. I am aware of the prohibition against "Sec-" headers
> in the client to server direction. Is there a requirement that
> XMLHttpRequest responses with unrecognized "Sec-" headers be rejected by
> user agents (and if so does this only apply in the browser case)?
>
> It's likely I just don't have enough context to understand the paragraph,
> but perhaps it could be clarified a bit.
>
> Regards,
>
> Joel Martin
>