Re: [hybi] About authentication mechanism

[Iñaki Baz Castillo <[e-mail]>]

(now correctly replying to the list address):


2011/6/29 Bob Gezelter <[e-mail]>:
> In summary, the WebSocket protocol does need a framework for
> authentication, and to enable interoperaability, a registry of published
> authentication schemes within that framework, with provisions for local
> extensions. It does not need a specific authentication scheme as part of
> the specification. Any such scheme should include provisions for
> unauthenticated/anonymous connections.

It makes lot of sense. I agree that an authentication framework should
be needed (better than a single authentication mechanism) and, of
course, an API for managing it from the client side.

The problem is that the WG seems not to want to cover this area at
all, and instead let the authentication process at WS subprotocol
level, leaving all the possible challenge computation at pure
JavaScript level (danger danger).

The fact that there is no broad consensus in the need of this
mechanism, neither interest, does not justify publishing the protocol
as it is. Come on WG, if nobody in the WG would care about which
encoding to use in WebSocket protocol, would the protocol born without
specifying it??? This is a protocol specification, not a FAQ, there
cannot be black holes.


-- 
Iñaki Baz Castillo
<[e-mail]>