Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[John Tamplin <[e-mail]>]

On Thu, Sep 8, 2011 at 11:06 AM, Richard L. Barnes <[e-mail]> wrote:

> It should also be noted that if the MASK bit is eliminated, then the
> recipient of a frame can't even parse it in the current format, since it
> doesn't know whether the first four octets are a masking key or not.


No, you know which side initiated the connection, so you know whether it is
a client frame or a server frame, and therefore whether it is masked.

 I expect it will get used as a WS-variant when dealing with non-browser
>> clients -- ie, between a frontend which handles
>> masking/aggregation/deaggregation/SSL and the ultimate backend, I would not
>> be surprised if there were unmasked client->server frames.  As long as all
>> the browser clients all enforce masking on their connections, the problem
>> masking was added for is averted.
>
>
> This seems to argue against Gabriel's proposed "c2s MUST / s2c MUST NOT".


No, since it would have to be a variant -- they aren't speaking WebSocket at
that point but a close derivative.  When we first added masking, IIRC Maciej
and others strongly objected to allowing clients to not mask in the
standard, even with a requirement that clients executing potentially hostile
code must mask, so I doubt relaxing it now would be any more acceptable.

-- 
John A. Tamplin
Software Engineer (GWT), Google