Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

["Richard L. Barnes" <[e-mail]>]

>>> - clients are not required to accept masked frames, so the server MUST NOT
>>> send masked frames. Whether clients accept or not masked frames has no
>>> importance.
>>> 
>>> - In order to ensure intermediary protection, clients MUST mask outgoing
>>> frames, and servers MUST NOT accept unmasked frames.
>> 
>> Let's not fool ourselves that having servers reject unmasked frames does anything about intermediary protection. 
>> 
>> If there's a WS stack out there that an attacker can force to send unmasked frames, then the game is already over.  The attacker just connects to a server under his control that will accept the unmasked frames, and the gig is up.
> 
> It's not what I'm targetting at all. My concern is that if we accept that
> servers don't check, then laziness will win and we'll quickly see a number
> of clients who won't mask at all because it works. And THEN server-side
> controlled software will be an issue. By ensuring that servers only accept
> masked frames, we force clients to always enable masking.

As Martin pointed out, though, we actually have good incentive alignment here -- the browsers know that they'll bear the pain if not masking causes problems.  So it doesn't seem like there's really any reason to believe that "laziness will win".

--Richard