Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[John Tamplin <[e-mail]>]

On Thu, Sep 8, 2011 at 12:14 PM, Peter Saint-Andre <[e-mail]>wrote:

> > OLD: "All frames sent from the client to the server are masked to avoid
> ..."
> > NEW: "Frames sent from the client to the server SHOULD be to avoid ..."
> >
> > NEW: "Servers MUST NOT reject un-masked frames, unless masking is
> required by local policy."
>
> Personally (not as your Area Director), that's fine with me.
>
> As your Area Director, I'd appreciate feedback from WG participants so
> that we can reach closure on this issue.


I don't object to changing this though I think previous discussions were
clear enough -- I wonder if all those who participated in the discussion at
that point will be around to restate their preferences.

If we do go with this, I would prefer an additional statement for
client->server, stating that if the client makes sends content controlled by
potentially hostile code over a WebSocket connection, it MUST mask the
contents.

I don't object strongly to changing server->client, but I think it is
totally silly to mask it as the server controls both the mask and the
content.  In fact, it may be a bit riskier, because the server could send
content that would be innocuous to something interpreting it as WebSocket
traffic, while the masked bytes are an attack against an intermediary.  So,
I would prefer to leave it as MUST NOT but if others feel strongly that
allowing it is useful I won't fight it.

-- 
John A. Tamplin
Software Engineer (GWT), Google