Re: [hybi] A WebSocket handshake

[Willy Tarreau <[e-mail]>]

On Tue, Oct 05, 2010 at 11:57:40PM -0700, Adam Barth wrote:
> On Tue, Oct 5, 2010 at 10:34 PM, Willy Tarreau <[e-mail]> wrote:
> > Adam, could you please recheck the importance for this handshake to
> > have the invalid hostname ? It really is the only blocking issue I
> > can think of. If it is absolutely needed, maybe we could use something
> > like "<valid-hostname>.websocket.invalid" instead so that at least the
> > server-side components can route the request to the proper location ?
> 
> Using an invalid host name is important because we don't want the
> attacker to be able to choose any of the bytes in the initial message.

OK I understand your point, but this is no different from what the
attacker can already do with plain HTTP.

> Of course, virtual hosting is important.  We'll probably want to
> include the real Host header in the encrypted "additional information"
> sent with the initial handshake message so that the WebSocket server
> can dispatch the connection to the appropriate virtual host.

Except that right now the virtual hosting it handled at the boundary
and the websocket will be handled at the internals. That said, the
host part of a URL must at least respect the limited charset of the
DNS system. We don't have the %-encoding of the plain URLs.

Regards,
Willy