Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Peter Saint-Andre <[e-mail]>]

<hat type='AD'/>

On 9/7/11 1:30 AM, Willy Tarreau wrote:
> On Wed, Sep 07, 2011 at 09:14:52AM +0200, Sylvain Hellegouarch wrote:
>> Since the masking and unmasking are the same operations, I fail to
>> understand the added complexity of server-to-client masking. Clients already
>> know how to unmask since they can mask in the first place with the same
>> operation.
> 
> Except they don't know the masking key. The purpose of masking is not
> to prevent a *client* from emitting the data it wants, but to prevent
> some *javascript code* running in a browser from doing so. The client
> is not the issue here, the issue is the fact that the attacker on the
> server side might easily make a client execute some controlled JS code.
> We want to ensure that someone who's present at both ends cannot easily
> control the byte stream sent by the client. And since the JS does not
> know the key, there's no easy way to perform the operation backwards
> first.

That's a fine explanation, but it's not clear in Section 10.3, which
seems to focus on intermediaries. This has caused confusion for at least
one IESG member, who commented that masking ought to be MUST-implement
but MAY-enable (i.e., there are some environments in which the client
would not need to mask). Perhaps modifications to Section 10.3 are in
order...

Peter

-- 
Peter Saint-Andre
https://stpeter.im/