Re: [hybi] [whatwg] HttpOnly cookie for WebSocket?

[Salvatore Loreto <[e-mail]>]

-as individual-

I agree too and I see the need to use HttpOnly.
I was just trying to highlight that at the end WebSocket does not only 
share port with HTTP/Web Server,
it also supposed to share other information (i.e. in this case cookies!!!).
The spec implicitly assume that the WebSocket server can access those 
information that the WebServer posses.



On 01/29/2010 08:22 AM, Ian Fette (????????) wrote:
> 2010/1/28 Salvatore Loreto <[e-mail] 
> <mailto:[e-mail]>>
>
>     Hi,
>
>     thanks to have moved back to the original question.
>     My original mail my was a call to discuss the technical aspects
>     openly in the mailing list, so to let the spec move forward.
>
>
>     I agree that it would be useful to use cookie on WebSocket,
>     however I have some perhaps stupid doubts and questions on its
>     usage that I'd like to be clarified
>
>     1) Is the usage of cookies optional or it is mandatory?
>     what will happen in the few cases where the WebSocket will be
>     established without the user has already logged into a page?
>
>
> I assume this would be left up to the application. If the server is 
> expecting some sort of authentication cookie and doesn't get one, it 
> can attempt to do authentication in an application specific manner 
> over the websocket connection, it can close the websocket connection, 
> it can transmit some applicaiton-specific error message to the client 
> over the websocket connection, etc.

I'd like the spec be more detailed about the correct server behaviour in 
this situation.


regards
Sal


On 01/30/2010 04:28 AM, Maciej Stachowiak wrote:
>
> On Jan 29, 2010, at 6:13 AM, Greg Wilkins wrote:
>
>> Ian Fette (????????) wrote:
>>
>>>
>>> cookies are already sent with WS, the only question is whether that
>>> includes or excludes cookies that are HttpOnly
>>
>> The upgrade request is a HTTP requests (well at least it should be
>> a HTTP request, and not just something that strongly resembles one),
>> so I believe HttpOnly cookies should be included.
>>
>> This would not expose the cookie and it's value to the
>> javascript in browser, nor can I think of any way that this reduces
>> the security provided by HttpOnly.
>
> I agree. The purpose of HttpOnly is to prevent the cookie from being 
> seen by scripting APIs, not to limit the network protocols over which 
> it is provided. Thus, sending it over WebSocket connections would be 
> in line with its purpose, and I think this is the case whether or not 
> we think the WebSocket upgrade request is or is not HTTP.
>
> Regards,
> Maciej
>