Re: [hybi] WebSocket handshake (HTTP and SSO)

[Hector Santos <[e-mail]>]

John Tamplin wrote:

> How many websites actually use HTTP Auth to protect the data?  In my
> experience, not many, because they want to control how the user logs
> in and of limitations like not supporting logout.  

John, one really can't design protocols based on subjective opinions 
like this.  HTTP AUTH is a standard and it should be expected it will 
be used regardless of the perceived numbers.

I still see many sites use HTTP AUTH. Our system allows operators to 
use BASIC, DIGEST and cookie-based form logins and mixed depending on 
the user browser setting. BASIC was the original offering and there 
are still many customers using it, mostly combined combined with SSL. 
DIGEST was still optional so you didn't guarantee it and JS was still 
something that wasn't forced upon their users - for security reasons.

Of course today, you see more JS logins and we push the more 
"acceptable" javascript based logins, but its not forced.

Also, PCI requirements can caused many non-standard javascript login 
implementations to fail. DIGEST+SSL with NONCE support is acceptable 
for PCI compliance.

Also, you can have a logout box even with BASIC/DIGEST by combining it 
with a session cookie.  Issuing a 403, combining with a 401 again when 
the session cookie is not there, will invalidate the credentials in 
most, if not all the browsers tested over the years.  Only when the 
user has cookies off,  do we redirect them to a "CLOSE YOUR BROWSER" page.

> Anyway, this strikes me as something to go over in detail when we are
> further down the road from where we are.  I think we need to finish up
> the framing and get basic agreement on how the handshake should look,
> and then we can take up how to get credentials to a WebSocket server.

+1, and when we get there, IMV a key design question will be if a 401 
will trigger a HTTP AUTH browser popup or whether the websocket class 
should have a  OnAuth() event where perhaps the JS can do a redirect 
to a login page.

For that matter, offer the main "page change flow" events:

   OnAuth()      triggered by 401
   OnRedirect()  triggered by 302

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com