[hybi] WebSocket handshake (HTTP and SSO)

[Brodie Thiesfield <[e-mail]>]

Hi,

I would like to request a clarification of the current thinking of the 
working group.

I am a developer keen to use WebSocket for its ability to have multiple 
simultaneous outstanding requests from our clients over a single socket. 
My company's product currently uses SOAP over HTTP, however we are 
currently experimenting with existing browser implementations of 
WebSocket (+ flash where not supported). We are now sending the same 
SOAP requests over WebSocket and having some good results in our trials.

However, we need to support this product in corporate networks, and for 
this reason one of our biggest requirements is to be able to support 
single sign on from the desktop.

Prior to the server allowing the WebSocket upgrade request with a 101 
header, will it be valid to require authentication via standard HTTP 401 
authorization required dialog? (i.e. via Microsoft negotiate, basic, 
digest, etc). Only after the client is successfully authorized would we 
want to accept the Upgrade and change to WebSocket.

The -76/-00 protocol would not permit this (due to the extra bytes in 
the Upgrade request) however the document 
https://datatracker.ietf.org/doc/draft-ietf-hybi-websocket-requirements/ 
(REQ 8) states that connections must be HTTP up to the acceptance of the 
Upgrade, and (REQ 9) that existing HTTP components should be able to be 
reused.

Is this document the latest thoughts of the WG? Should I continue with 
the assumption that it is likely that this style of WebSocket handshake 
would be supported?

Regards,
Brodie