Re: [hybi] A WebSocket handshake

[Willy Tarreau <[e-mail]>]

On Thu, Oct 07, 2010 at 05:42:10PM +1100, Greg Wilkins wrote:
> Exactly - the security architecture of the web makes that safe.
> No cookies or credentials for goodguy.somehost.com/secret/ are going
> to be sent to evilgenius.somehost.com/attack.

That's a good point that you're talking about cookies, Greg, because
that's precisely one element which we will definitely need, and which
will imply that some parts of the handshake will be variable. Also, I
don't see why we should make the handshake stricter than whatever an
attacker already has control over in a browser. We just need the
handshake to be as robust as any HTTP handshake, not more. If an
attacker has control over the browser and the WS handshake does not
permit anything, he will still be able to use plain HTTP and have much
more control. So we can relax the rules a bit without turning browsers
into massive attack sources.

Regards,
Willy