Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Willy Tarreau wrote:
> No Adam. All what you're trying to do is to protect against a socket data
> being taken as a new request. As I already said it several times now, we
> just have to set "Connection: close" in the request to put an end on that.
> We definitely don't want to risk that confusion !
>
> >From draft-ietf-httpbis-p1-messaging-11 :
>    7.1.2.1. Negotiation
>    An HTTP/1.1 server MAY assume that a HTTP/1.1 client intends to
>    maintain a persistent connection unless a Connection header including
>    the connection-token "close" was sent in the request.
>    ...
>    If either the client or the server sends the close token in the
>    Connection header, that request becomes the last one for the
>    connection.
>
> As you see, this is by definition, so we must use the close header and
> we need to focus on real cross-protocol attacks, not the ones between
> WS and HTTP servers based on the second request.
>   

+1

-- Scott