Re: [hybi] Intermediaries and idle connections (was Re: Technical feedback.)

[Jamie Lokier <[e-mail]>]

Maciej Stachowiak wrote:
>    As I understand it, the reason is security. If you strictly limit the
>    format of the handshake interchange, then its less likely that
>    WebSocket could be abused to talk to a non-WebSocket server - if you
>    need to trick it into echoing back something very specific, that's a
>    harder problem. It also makes the checks that the handshake was
>    correct simpler and therefore potentially more robust.

With that goal, it would be better to make the handshake response
*not* valid HTTP, and deliberately choose something that no HTTP
server would produce and no HTTP proxy would be likely to relay.

That would be better for security and for blocking relay through
unaware proxies, both of which are stated goals for the protocol.

-- Jamie