Re: [hybi] Handshake was: The WebSocket protocol issues.

[Greg Wilkins <[e-mail]>]

On 10 October 2010 03:39, Eric Rescorla <[e-mail]> wrote:
> Accordingly, I'd like to have a design that makes as minimal
> assumptions about the behavior of the target server as possible and I'd like
> those
> assumptions to be rooted to the extent possible in behaviors which either
> (1) are required by standards or (2) are required for the server to function
> interoperably at all, if not both. Do you disagree?

I agree to some extent.

but note that the standards have several requirements on 1xx responses
(eg no bodies, in response to an upgrade) that the PHP script in the
supposed attack violates.  So according  to your criteria above we
would not need to consider this, even though the evidence is that a
commonly deployed server allows it.

As upgrade is an underutilized mechanism, it may be that there are
many implementations out there that do not enforce this aspect of the
specification.    This is unfortunate as it does peel back a layer of
defence that we would otherwise have.    But so long as this is a not
a necessary layer for defending initial deployments, then I think it
would be sufficient for us to raise issues on the commonly deployed
servers indicating they are breaking the specification and creating
security concerns by allowing applications to generate 101 responses.

With regards to my null trial - I agree that such "surveys" (specially
with a sample size of 1) are not really indicative, only somewhat
informative.      However, I do think we need to analyse our framing
from the perspective of could WS frames be mistaken for HTTP requests.

regards