Re: [hybi] Handshake was: The WebSocket protocol issues.

[Eric Rescorla <[e-mail]>]

On Sat, Oct 9, 2010 at 1:18 AM, Greg Wilkins <[e-mail]> wrote:

> On 9 October 2010 11:43, Adam Barth <[e-mail]> wrote:
> > I don't know why you think that's so hard to set the response status.
> > There's a PHP function does exactly that:
>
> Interesting - I tested it with apache2 and it does allow 1xx
> responses, even though they are not actually legal HTTP, specially to
> send 1xx responses with message bodies.
>
> But that's why we have defence in depth.
>

Defense in depth is an important security concept, but in general when I
design security systems, my objective is to have each layer of the defense
in depth be something I have a lot of confidence in. Certainly, I'd rather
have a single security layer that I had a very high level of confidence in
than several layers that I only sort-of-trusted.


I tried to spoof the content-length, but apache corrected the wrong
> value so that all the content the php script provided was sent as the
> body of the 101 response.
>
> Also my attempts to send a null character resulted in 501 Method Not
> Implemented responses and a closed connection.


I'm generally not very persuaded by this kind of experiment. There is a huge
diversity
of Web server behaviors and so just because one server doesn't let you do X
doesn't
mean that another server doesn't. It's not really practical to have a
complete survey
of Web server behavior for the vast majority of questions.

Accordingly, I'd like to have a design that makes as minimal
assumptions about the behavior of the target server as possible and I'd like
those
assumptions to be rooted to the extent possible in behaviors which either
(1) are required by standards or (2) are required for the server to function
interoperably at all, if not both. Do you disagree?

-Ekr