Re: [hybi] [Technical Errata Reported] RFC6455 (4398)

[Barry Leiba <[e-mail]>]

This seems sensible, and seems like it ought to be "Held for Document
Update", yes?  Unless this truly is something that was meant to be in
the document originally, and was accidentally left out... which I
don't think is the case.

Barry

On Wed, Jun 24, 2015 at 5:36 AM, RFC Errata System
<[e-mail]> wrote:
> The following errata report has been submitted for RFC6455,
> "The WebSocket Protocol".
>
> --------------------------------------
> You may review the report below and at:
> http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=4398
>
> --------------------------------------
> Type: Technical
> Reported by: Mike West <[e-mail]>
>
> Section: 4.1
>
> Original Text
> -------------
> 1. The components of the WebSocket URI passed into this algorithm
>    (/host/, /port/, /resource name/, and /secure/ flag) MUST be
>    valid according to the specification of WebSocket URIs specified
>    in Section 3.  If any of the components are invalid, the client
>    MUST _Fail the WebSocket Connection_ and abort these steps.
>
> Corrected Text
> --------------
> 1. The components of the WebSocket URI passed into this algorithm
>    (/host/, /port/, /resource name/, and /secure/ flag) MUST be
>    valid according to the specification of WebSocket URIs specified
>    in Section 3.  If any of the components are invalid, the client
>    MUST _Fail the WebSocket Connection_ and abort these steps.
>
> 2. If secure is false, and the algorithm in Mixed Content's "§5.1
>    Does settings object restrict mixed content?" returns Restricts
>    Mixed Content when applied to client's entry script's relevant
>    settings object's, then the client MUST fail the WebSocket
>    connection and abort the connection.
>
> Notes
> -----
> This change is suggested by the W3C's "Mixed Content" document (https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration), and will bring WebSockets' behaviors into line with XMLHttpRequest, EventSource, and Fetch, all of which act as though there was a network error when blocking a mixed content request, rather than throwing a SecurityError exception.
>
> Instructions:
> -------------
> This erratum is currently posted as "Reported". If necessary, please
> use "Reply All" to discuss whether it should be verified or
> rejected. When a decision is reached, the verifying party (IESG)
> can log in to change the status and edit the report, if necessary.
>
> --------------------------------------
> RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
> --------------------------------------
> Title               : The WebSocket Protocol
> Publication Date    : December 2011
> Author(s)           : I. Fette, A. Melnikov
> Category            : PROPOSED STANDARD
> Source              : BiDirectional or Server-Initiated HTTP APP
> Area                : Applications
> Stream              : IETF
> Verifying Party     : IESG
>