Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

[Sylvain Hellegouarch <[e-mail]>]

On Wed, Sep 7, 2011 at 9:30 AM, Willy Tarreau <[e-mail]> wrote:

> On Wed, Sep 07, 2011 at 09:14:52AM +0200, Sylvain Hellegouarch wrote:
> > Since the masking and unmasking are the same operations, I fail to
> > understand the added complexity of server-to-client masking. Clients
> already
> > know how to unmask since they can mask in the first place with the same
> > operation.
>
> Except they don't know the masking key. The purpose of masking is not
> to prevent a *client* from emitting the data it wants, but to prevent
> some *javascript code* running in a browser from doing so. The client
> is not the issue here, the issue is the fact that the attacker on the
> server side might easily make a client execute some controlled JS code.
> We want to ensure that someone who's present at both ends cannot easily
> control the byte stream sent by the client. And since the JS does not
> know the key, there's no easy way to perform the operation backwards
> first.
>
>
I suggest section 5.1 to be clarified with that point then.

-- 
- Sylvain
http://www.defuze.org
http://twitter.com/lawouach