Re: [hybi] A WebSocket handshake

[Greg Wilkins <[e-mail]>]

On 7 October 2010 01:21, Adam Barth <[e-mail]> wrote:
> We'll put the WebSocket URL in the additional information that comes
> with the initial message.  We can either break that up into a request
> line and a Host header, or we can just include the whole URL as such.

I think you make the server more vulnerable to DOS attacks by delaying
consideration of the URL and subprotocol.

Frequently servers will run many applications on many virtual hosts,
real hosts and context paths.  Only a subset of these may support
websockets.  This proposal would mean that the server would need to
accept the connection and thus cause the client onOpen even to first,
before it had validated the connection was to an application that can
handle websocket.  While I don't see any new vulnerability flowing
directly from this, I believe that it is not a desirable state of
affairs from either a security or resource allocation point of view.

> The point of putting in the additional information is so that it can
> be encrypted, preventing the attacker from choosing any of the bytes
> on the wire.

If we really are going to have a content free handshake that exchanges
keys so that the rest of the connection can be encrypted - then we
should just use TLS.

I see little value and significant risks in inventing some TLS-lite handshake.

I think that we should improve the upgrade proposal to the best we
can, and consider a concrete TLS proposal, and then we can consider if
we support one or  the other or both.

regards