Re: [hybi] WebSocket handshake (HTTP and SSO)

[Eric Rescorla <[e-mail]>]

On Mon, Aug 30, 2010 at 9:21 AM, Scott Ferguson <[e-mail]> wrote:

> John Tamplin wrote:
>
>> On Sun, Aug 29, 2010 at 11:01 PM, Greg Wilkins <[e-mail]> wrote:
>>
>>
>>> From the point of view of a combined HTTP/websocket server, it would
>>> be simplest if we can just use existing mechanisms for things like
>>> BASIC, DIGEST, OAUTH, OpenID, acegi, NTML etc. etc.
>>> So while there may be better security mechanism that could be applied
>>> to websocket only client and servers, it would be unproductive to
>>> prohibit the use of existing security mechanism if a way can be found
>>> to use them.
>>>
>>>
>>
>> How many websites actually use HTTP Auth to protect the data?
>>
>
> Non-browser clients do. With Hessian (binary RPC over HTTP), HTTP auth is
> very typical.
>
> I'd prefer to build in WebSocket support to allow for a piggy-backed
> DIGEST-style authentication, allowing the server response to send its
> challenge and replace the clients first random bytes with an
> authentication/hello frame, which would be the DIGEST credentials.


Is the desire here:
(1) to actually have it use digest.
(2) to be digest password store compatible.
(3) to be password compatible and challenge/response

I ask because depending on the answer this is either an argument for or
against TLS-only.

-Ekr