Re: [hybi] hybi Digest, Vol 51, Issue 14

[Adam Rice <[e-mail]>]

On 2 June 2013 02:55, Scott Morgan <[e-mail]> wrote:

> Yes and actually I am going to change the way I do this after reading the
> rfc.   I am going to use regular http(s) for the authentication part so
> this would change to the following.
>
> 1 Browser sends authentication to the server over https
> 2 Server notes the ip address of the request and responds with a ws url to
> the client if successful ie.  wss://example.com/valid?session=123
> 3 Browser connects to url wss://example.com/valid?session=123
> 4 Server checks the ip address of the original https request with the wss
> connection
>     to make sure they are the same, and takes appropriate action (closes
> the wss connection if they are NOT, or some other appropriate action)
>
>
It seems to me that storing the session ID in a cookie would make this
easier.

If you want to put the session ID in a URL, I would recommend making it
single-use, although that means you need some mechanism to get a new
session ID if the WebSocket connection fails.

RFC6455 allows WebSocket connections to use a different proxy than HTTPS
connections. Although I'm not aware of any client that actually implements
this, you should not assume that all requests from the same sender will
come from the same IP.