Re: [hybi] Handshake was: The WebSocket protocol issues.

[Alexander Voronin <[e-mail]>]

Here we'r talking not about handshake but about cross-protocol attacks. So
websockets as two-stage process is invulnerable to this attack. If browser
creates and openes websocket than we sure that data will be sent into HTTP
stream. If handshake fails no data will be sent. So what kind of
cross-protocol attacks we'r still trying to avoid? Referenced document with
POST example has nothing in common with our issue.

In reference to handshake - as noticed sending data in GET request is a bad
idea. And I still believe that old style handshake will work for any kind of
proxy chains using just HTTP result codes.

2010/9/24 Willy Tarreau <[e-mail]>

>
>
> We all agree about that, but as several people have indicated, this minimal
> handshake requires two round trips because it still does not validate the
> fact that the whole chain can exchange data in both directions. That's why
> there are thoughts about improving from that point.
>
> Regards,
> Willy
>
>


-- 
когда я опустился на самое дно, снизу мне постучали..