[hybi] opening headers: multiplicity / port in host

[Tobias Oberstein <[e-mail]>]

Polishing up our WS handshake code, I have 3 short questions regarding headers:

1)
The spec is explicit about the allowed header multiplicity in opening handshake requests and responses for the headers:

sec-websocket-key
sec-websocket-accept
sec-websocket-protocol
sec-websocket-extensions
sec-websocket-version

I couldn't find text mentioning multiplicity wrt:

origin (was: sec-websocket-origin)
host
connection
upgrade

Is the following right?

Host header MUST appear exactly once in request (by HTTP spec).

Origin header MUST NOT appear more than once in request (exactly once for browser clients).

Upgrade/Connection: may contain multiple (comma separated) values, may appear more than once (by HTTP spec).


2) Upgrade header multiplicity
 
Hybi-17:
"""
   5.   The request MUST contain an "Upgrade" header field whose value
        is equal to "websocket".

   6.   The request MUST contain a "Connection" header field whose value
        MUST include the "Upgrade" token.
"""

The HTTP spec seems to allow multiple values (and presumably also multiple headers)

Upgrade: HTTP/2.0, SHTTP/1.3, IRC/6.9, RTA/x11

So is it allowed for a WS client to send i.e.

Upgrade: WebSocket, RTA/x11

and the server accepts WS only, sending back

Upgrade: WebSocket

?

Note that the "Connection" header description in the spec has "extra language"
"MUST include the ... token", which seems to allow multiple values in a single
Connection header as well as multiple Connection headers.

Should the Upgrade header be treated the same?


3) Host header port?

Hybi-17:
"""
   4.   The request MUST contain a "Host" header field whose value is
        equal to /host/.
"""

It does not say "equal to /host/[:/port/]".

However, i.e. both Firefox and Chrome will send i.e.

Host: 127.0.0.1:9001

Are both forms allowed?

Host: /host/
Host: /host/:/port/

And if the client uses the 2nd, validate that /port/ is the one the server is listening on?