Re: [hybi] WebSocket handshake (HTTP and SSO)

[Hector Santos <[e-mail]>]

Greg Wilkins wrote:
> John,
> 
> From the point of view of a combined HTTP/websocket server, it would
> be simplest if we can just use existing mechanisms for things like
> BASIC, DIGEST, OAUTH, OpenID, acegi, NTML etc. etc.

It sounds like it might be simple, but it must be explored. The 
methods are drastically different in its human login I/O method.

> So while there may be better security mechanism that could be applied
> to websocket only client and servers, it would be unproductive to
> prohibit the use of existing security mechanism if a way can be found
> to use them.

The issue we found are mix authentication issues with similar dual or 
multi-channel client connections. This is a session management issue 
that has to be controlled and secured by the hosting server.

I think the better question is if we think allowing websocket for HTTP 
AUTH authentication is useful and that would include the browser 
websocket response 401 detection to popup the browser HTTP AUTH based 
login box.

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com