Re: [hybi] Concerns about Origin

[Sylvain Hellegouarch <[e-mail]>]

On Mon, Nov 22, 2010 at 5:58 PM, John Tamplin <[e-mail]> wrote:

> On Mon, Nov 22, 2010 at 11:38 AM, Simon Pieters <[e-mail]> wrote:
> >> APIs for server apps should have a hook to the handshake event, so
> >> that apps can participate in the handshake. Apps have an opportunity
> >> here to check Origin, set cookies, etc. per connection.
> >
> > pywebsocket allows apps to do extra checks in the handshake, but I'd like
> to
> > take a step further and make the origin choice a required step for the
> app
> > writer.
>
> I would prefer the default behavior of the server to be that the
> origin has to match exactly, but that the app can override it, or when
> the app is registered with the server it gives a list of acceptable
> Origins.
>
>
That's definitely how I'd implement it as well. The case that's left is when
the app doesn't provide any Origin, what should the server do? Default to
Origin=Host? Or should the request be rejected (I don' t quite see the point
of that mind you). It's the end, it's similar to the Sec-WebSocket-Protocol
header which is left up to the app writer to decide how to react and either
case.

-- 
- Sylvain
http://www.defuze.org
http://twitter.com/lawouach