Re: [hybi] About authentication mechanism

[Iñaki Baz Castillo <[e-mail]>]

2011/6/22 Ian Fette (イアンフェッティ) <[e-mail]>:
>> Ok, but take into account that not all the WS connections would be
>> preceded by an access to a web page. Let's imagine a desktop wigdet
>> (or an Android app!) that directly open a WS connection (without
>> opening first a web page, so the client cannot authenticate via an
>> HTML form in "any custom way"). What to do then? How to prompt the
>> user for credentials? which authentication mechanism to use? So there
>> would be needed:
>
> A desktop widget / android app / ... surely already faces this problem with
> whatever communication mechanism they use, and I would be frankly amazed if
> they expected to solve it with http auth...

So:

- Web developers don't like HTTP authentication in web pages and
prefer authentication at application level. I agree, it's nicer, but
it relies on the fact that HTTP usualy carries a web page (application
data) in which the user can fill a form, submit, and get
authentication and a Cookie for a session.

- This WG does not want to cover authentication mechanism at all for
WebSocket protocol, and instead leave it again at application level.
But here there is no a rendered web page in which the user can fill a
login form. So...

Assuming that any websocket connection would be preceded by a web
access (in which login and a session Cookie has been got) would be a
terrible error IMHO. So, does nobody agree that WS needs a built-in
authentication mechanism? Honestly I cannot understand. Hope I miss
something very important in this topic.


PS: Ian, could I know what you propose on this topic? For now you have
given reasons not to mandate HTTP auth. Could I know how will Google
authenticate WS connections in separate just-WS-servers? maybe
validating the Cookie header (initially retrieved from the web page)
against a centralized storage backend? or maybe you plan to build an
authentication mechanism within the WS carried subprotocol? (just
wondering, I don't want to know Google's internals).

Regards.



-- 
Iñaki Baz Castillo
<[e-mail]>