Re: [hybi] Comments about draft-13

["Richard L. Barnes" <[e-mail]>]

>> Also, to re-iterate a comment I made earlier, "Sec-Websocket-Protocol" should just be "Websocket-Protocol", since it is not "Sec" -- scripts can set the value pretty much directly.
>> 
> Let's please not change the header field name now, this will break implementations of all earlier versions, some of which are already deployed.
> 

I wouldn't have a problem with this had W3C not assigned a semantic to the field name:
"
[Do not allow a script to set a header] if /header/ is a case-insensitive match for one of the following headers [...] or if the start of /header/ is a case-insensitive match for Proxy- or Sec- (including when header is just Proxy- or Sec-).
"
<http://www.w3.org/TR/XMLHttpRequest/>

That behavior has set the expectation that Sec- header fields cannot be set by scripts, which is not really true of Sec-Websocket-Protocol.  As the WS API is specified now, a script can provide an arbitrary UTF-8 string.  So either this spec should constrain the syntax of the field (e.g., a sequence of ASCII tokens, which is what actually seems to be desired) or remove the "Sec-".

--Richard