Re: [hybi] Redesigning the Web Socket handshake

[Justin Erenkrantz <[e-mail]>]

On Wed, Feb 3, 2010 at 7:52 AM, Maciej Stachowiak <[e-mail]> wrote:
> The goal is more like "first few bytes" than "probably first packet". Remember, we're trying to defend against cross-protocol attacks, so what well-behaved clients and servers will do is not super relevant. I am more concerned with the security of the protocol than pleasing the aesthetic sense of HTTP gurus.

No, but what matters is what well-behaved servers will do when they
accidentally break the only security mechanism when they reset the
status reason and clear those hash'd bytes.

Many servers and proxies will allow the status reason to be overriden
and replaced (think localization).  The failure case is going to be
abysmal to track down and completely fatal - the handshakes will fail
because some intermediary is rewriting the status reason and there
won't be *anything* at all that a client can do about it.  Suck.  At
least if it is in a separate HTTP header, it's a pretty good bet that
it won't be touched and will survive most interactions with reasonable
servers and intermediaries.

>>> 2) The hash should also include the request origin and some fixed
>>> WebSocket-specific string (e.g. "WebSocket::"). (He actually suggested 'HMAC
>>> the string "Web
>>> Socket::" and origin of WebSocket request using the nonce as a key' but I'm
>>> not sure if he was serious.)
>>
>> Using the origin IP introduces a lot of problems when there are
>> reverse proxies involved.
>
> The origin is not an IP address. I'm talking about what goes in the WebSocket-Origin header. See the spec for an explanation and examples.

Oops.  My bad.  (Perhaps we should consider another name besides
"origin" - that's a very overloaded term?)  -- justin