Re: [hybi] workability (or otherwise) of HTTP upgrade

[Scott Ferguson <[e-mail]>]

Pat McManus @Mozilla wrote:
> CONNECT is different in that it is more reasonable to assume it doesn't
> show up in the proxy list of "things I don't understand". If nothing
> else has made them aware viruses have done so....  We aren't relying on the
> handling of CONNECT being unknown, at least as a first line of defense.
>   

This is a good point.

> That being said, I've always preferred that WebSockets not be HTTP/80
> based at all - but the group had really reached consensus on that topic
> and I believe in working forward within that consensus. I think the
> minutes say the "focus will be on leveraging HTTP infrastructure" while
> noting that it doesn't actually preclude the group from looking at other
> alternatives - but I read the clear sense of the group as wanting to
> base WebSockets on the one-true-port.
>   

I think that assumption should be revisited because CONNECT no longer 
significantly leverages HTTP infrastructure.

When the draft used GET+Upgrade, servers could reuse things like the 
HTTP authentication, cookie headers, etc., and reuse the existing 
protocol stack for things like the normal servlet/script dispatch, 
config, admin, logging, etc.

With CONNECT, since that reuse doesn't occur (or at least no more than a 
new port and handshake would), the leveraging benefit goes away and 
we're left with bypassing firewalls as the only benefit of using port 80.

-- Scott



> I am in favor of revisiting the non HTTP approach, but I don't think
> there will be agreement on it. And lacking agreement, I think CONNECT is
> workable and a way forward to make some progress.
>
> -Patrick
>
>