Re: [hybi] WebSocket handshake (HTTP and SSO)

[John Tamplin <[e-mail]>]

On Sun, Aug 29, 2010 at 11:01 PM, Greg Wilkins <[e-mail]> wrote:
> From the point of view of a combined HTTP/websocket server, it would
> be simplest if we can just use existing mechanisms for things like
> BASIC, DIGEST, OAUTH, OpenID, acegi, NTML etc. etc.
> So while there may be better security mechanism that could be applied
> to websocket only client and servers, it would be unproductive to
> prohibit the use of existing security mechanism if a way can be found
> to use them.

How many websites actually use HTTP Auth to protect the data?  In my
experience, not many, because they want to control how the user logs
in and of limitations like not supporting logout.  If you let the WS
server return a 401 so the browser asks for credentials, I don't see
how you support SSO, OpenID, OAUTH, etc.  Since I would expect
virtually all WebSocket client apps to have been loaded from a normal
web server, they already have their own authentication for RPC/etc
requests back to that server for protected resources.  In that case,
what you want is to just pass those credentials to the server, whether
by some first-class WebSocket facility, passing HTTP cookies over
WebSocket, or letting the app send them in a WebSocket message.

Anyway, this strikes me as something to go over in detail when we are
further down the road from where we are.  I think we need to finish up
the framing and get basic agreement on how the handshake should look,
and then we can take up how to get credentials to a WebSocket server.

-- 
John A. Tamplin
Software Engineer (GWT), Google