Re: [hybi] [Technical Errata Reported] RFC6455 (4398)

[Mike West <[e-mail]>]

"Held for Document Update" is what I'm going for, yes. This isn't something
that was left out of the original document, but a change in the way mixed
content handling has been specified and implemented.

-mike

--
Mike West <[e-mail]>, @mikewest

Google Germany GmbH, Dienerstrasse 12, 80331 München,
Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der
Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth
Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

On Wed, Jun 24, 2015 at 2:09 PM, Barry Leiba <[e-mail]>
wrote:

> This seems sensible, and seems like it ought to be "Held for Document
> Update", yes?  Unless this truly is something that was meant to be in
> the document originally, and was accidentally left out... which I
> don't think is the case.
>
> Barry
>
> On Wed, Jun 24, 2015 at 5:36 AM, RFC Errata System
> <[e-mail]> wrote:
> > The following errata report has been submitted for RFC6455,
> > "The WebSocket Protocol".
> >
> > --------------------------------------
> > You may review the report below and at:
> > http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=4398
> >
> > --------------------------------------
> > Type: Technical
> > Reported by: Mike West <[e-mail]>
> >
> > Section: 4.1
> >
> > Original Text
> > -------------
> > 1. The components of the WebSocket URI passed into this algorithm
> >    (/host/, /port/, /resource name/, and /secure/ flag) MUST be
> >    valid according to the specification of WebSocket URIs specified
> >    in Section 3.  If any of the components are invalid, the client
> >    MUST _Fail the WebSocket Connection_ and abort these steps.
> >
> > Corrected Text
> > --------------
> > 1. The components of the WebSocket URI passed into this algorithm
> >    (/host/, /port/, /resource name/, and /secure/ flag) MUST be
> >    valid according to the specification of WebSocket URIs specified
> >    in Section 3.  If any of the components are invalid, the client
> >    MUST _Fail the WebSocket Connection_ and abort these steps.
> >
> > 2. If secure is false, and the algorithm in Mixed Content's "§5.1
> >    Does settings object restrict mixed content?" returns Restricts
> >    Mixed Content when applied to client's entry script's relevant
> >    settings object's, then the client MUST fail the WebSocket
> >    connection and abort the connection.
> >
> > Notes
> > -----
> > This change is suggested by the W3C's "Mixed Content" document (
> https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration),
> and will bring WebSockets' behaviors into line with XMLHttpRequest,
> EventSource, and Fetch, all of which act as though there was a network
> error when blocking a mixed content request, rather than throwing a
> SecurityError exception.
> >
> > Instructions:
> > -------------
> > This erratum is currently posted as "Reported". If necessary, please
> > use "Reply All" to discuss whether it should be verified or
> > rejected. When a decision is reached, the verifying party (IESG)
> > can log in to change the status and edit the report, if necessary.
> >
> > --------------------------------------
> > RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
> > --------------------------------------
> > Title               : The WebSocket Protocol
> > Publication Date    : December 2011
> > Author(s)           : I. Fette, A. Melnikov
> > Category            : PROPOSED STANDARD
> > Source              : BiDirectional or Server-Initiated HTTP APP
> > Area                : Applications
> > Stream              : IETF
> > Verifying Party     : IESG
> >
>