Re: [hybi] [whatwg] HttpOnly cookie for WebSocket?

[Maciej Stachowiak <[e-mail]>]

On Jan 29, 2010, at 6:13 AM, Greg Wilkins wrote:

> Ian Fette (イアンフェッティ) wrote:
> 
>> 
>> cookies are already sent with WS, the only question is whether that
>> includes or excludes cookies that are HttpOnly
> 
> The upgrade request is a HTTP requests (well at least it should be
> a HTTP request, and not just something that strongly resembles one),
> so I believe HttpOnly cookies should be included.
> 
> This would not expose the cookie and it's value to the
> javascript in browser, nor can I think of any way that this reduces
> the security provided by HttpOnly.

I agree. The purpose of HttpOnly is to prevent the cookie from being seen by scripting APIs, not to limit the network protocols over which it is provided. Thus, sending it over WebSocket connections would be in line with its purpose, and I think this is the case whether or not we think the WebSocket upgrade request is or is not HTTP.

Regards,
Maciej