Re: [hybi] Experiment comparing Upgrade and CONNECT handshakes

[John Tamplin <[e-mail]>]

On Fri, Nov 26, 2010 at 11:29 PM, Greg Wilkins <[e-mail]> wrote:
> One of the reasons expressed that websocket should use framing is that it
> was considered unsafe to have free access to a socket, even after a
> handshake, for reasons like the vulnerability you have highlighted. Framing
> can prevent user supplied content looking like HTTP requests, plus there are
> some proposals that further harden framing against such spoofing.  Also the
> Hello proposal (which does not involved an extra round trip) offers further
> protection.

Note that adding Hello frames or arbitrary other verification that a
real WebSocket client is connecting doesn't help -- in this attack
scenario, the attacker is running their JS code in the browser and
their code on the server, and it sets up a real WebSocket connection.
Unless the payload is masked, you have to rely on the handshake and
framing ensuring that a transparent proxy doesn't accept WebSocket
payload content as if it were an HTTP request.  Also note that since
the attacker controls the server, they can add extra headers to the
Upgrade response which will be ignored by the WebSocket client but may
confuse the transparent proxy.

-- 
John A. Tamplin
Software Engineer (GWT), Google