Re: [hybi] WebSocket handshake (HTTP and SSO)

[Brodie Thiesfield <[e-mail]>]

 All,

On 30/08/2010 9:44 AM, Greg Wilkins wrote:
> My feeling is that the browsers vendors are less keen on supporting
> HTTP features on websocket handshakes, while the server vendors are
> very keen.  I think some time and experience with real deployments is
> needed for those two positions to converge.  Thus I think at this
> stage having the prohibition on such features removed is the best we
> can expect and that will allows  servers/browsers to experiment with
> supporting HTTP features.

I can accept that it may not happen, as long as it is theoretically
possible. It seemed that it would be from the current documents, but it
obviously still has some debate to continue. It would just be easier for
us to have the browser handle the user login via the standard HTTP
authentication conversation.

Regards,
Brodie


> On 29 August 2010 19:21, Brodie Thiesfield <[e-mail]> wrote:
>> Hi,
>>
>> I would like to request a clarification of the current thinking of the
>> working group.
>>
>> I am a developer keen to use WebSocket for its ability to have multiple
>> simultaneous outstanding requests from our clients over a single socket. My
>> company's product currently uses SOAP over HTTP, however we are currently
>> experimenting with existing browser implementations of WebSocket (+ flash
>> where not supported). We are now sending the same SOAP requests over
>> WebSocket and having some good results in our trials.
>>
>> However, we need to support this product in corporate networks, and for this
>> reason one of our biggest requirements is to be able to support single sign
>> on from the desktop.
>>
>> Prior to the server allowing the WebSocket upgrade request with a 101
>> header, will it be valid to require authentication via standard HTTP 401
>> authorization required dialog? (i.e. via Microsoft negotiate, basic, digest,
>> etc). Only after the client is successfully authorized would we want to
>> accept the Upgrade and change to WebSocket.
>>
>> The -76/-00 protocol would not permit this (due to the extra bytes in the
>> Upgrade request) however the document
>> https://datatracker.ietf.org/doc/draft-ietf-hybi-websocket-requirements/
>> (REQ 8) states that connections must be HTTP up to the acceptance of the
>> Upgrade, and (REQ 9) that existing HTTP components should be able to be
>> reused.
>>
>> Is this document the latest thoughts of the WG? Should I continue with the
>> assumption that it is likely that this style of WebSocket handshake would be
>> supported?
>>
>> Regards,
>> Brodie
>>
>> _______________________________________________
>> hybi mailing list
>> [e-mail]
>> https://www.ietf.org/mailman/listinfo/hybi
>>