Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard
David Endicott <dendicott@gmail.com> Fri, 22 July 2011 13:47 UTC
Return-Path: <dendicott@gmail.com>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id B94F421F8531; Fri, 22 Jul 2011 06:47:40 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -3.573
X-Spam-Level:
X-Spam-Status: No, score=-3.573 tagged_above=-999 required=5 tests=[AWL=0.025, BAYES_00=-2.599, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_LOW=-1]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id 5Vxt6zZSq9-o; Fri, 22 Jul 2011 06:47:40 -0700 (PDT)
Received: from mail-ww0-f44.google.com (mail-ww0-f44.google.com [74.125.82.44]) by ietfa.amsl.com (Postfix) with ESMTP id 1527821F8515; Fri, 22 Jul 2011 06:47:33 -0700 (PDT)
Received: by wwe5 with SMTP id 5so1517549wwe.13 for <multiple recipients>; Fri, 22 Jul 2011 06:47:33 -0700 (PDT)
DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=gamma; h=mime-version:in-reply-to:references:date:message-id:subject:from:to :cc:content-type; bh=UGfwX4W0mqUSwtSnf/ahEA6EjDJLU+9IqYq4bVewc50=; b=nW5SeYF22y8sZPh0UW7EBLsdmGm8SlYF9c+VwpJyaHcYoQfbGtdNPBI+VMFgd5qKNv e1s5GkY/jVI7Xwnv5cWt3DmyUEhx2WulVYYuSDUVBruBw1I3Jr3azW+VZVZOT8yokSB7 XUdFcvMwHAhV5i8HN+G3MI8+eWl5w/m3wzM+o=
MIME-Version: 1.0
Received: by 10.216.1.200 with SMTP id 50mr2100722wed.33.1311342453158; Fri, 22 Jul 2011 06:47:33 -0700 (PDT)
Received: by 10.216.39.197 with HTTP; Fri, 22 Jul 2011 06:47:31 -0700 (PDT)
In-Reply-To: <CAP992=GuGMB7e=skLnW=gjQU0rnbh2BD2A_bRyy3Fkrphmj=VQ@mail.gmail.com>
References: <20110711140229.17432.23519.idtracker@ietfa.amsl.com> <CALiegfk0zVVRBbOP4ugsVXKmcLnryujP6DZqF6Bu_dC2C3PpeQ@mail.gmail.com> <9031.1311082001.631622@puncture> <CALiegfk_GLAhAf=yEe6hYw2bwtxEwg9aJN+f0Bm9he5QgsRavA@mail.gmail.com> <CAP992=Ft6NwG+rbcuWUP0npwVNHY_znHmXmznBQO_krMo3RT6g@mail.gmail.com> <CALiegfmTWMP3GhS1-k2aoHHXkUkB+eWqV=2+BufuWVR1s2Z-EA@mail.gmail.com> <20110721163910.GA16854@1wt.eu> <CAP992=FrX5VxP2o0JLNoJs8nXXba7wbZ6RN9wBUYC0ZSN_wbAg@mail.gmail.com> <9031.1311270000.588511@puncture> <CALiegf=pYzybvc7WB2QfPg6FKrhLxgzHuP-DpuuMfZYJV6Z7FQ@mail.gmail.com> <CAP992=FJymFPKcPVWrF-LkcEtNUz=Kt9L_ex+kLtjiGjL1T46w@mail.gmail.com> <4E28A51F.4020704@callenish.com> <9031.1311286867.939466@puncture> <4E28BA9D.6010501@callenish.com> <CAP992=GedTEfimykCWwdwm=BsZdwFRJO36EO0a_o7iejURJ+tQ@mail.gmail.com> <9031.1311328519.488604@puncture> <CAP992=GuGMB7e=skLnW=gjQU0rnbh2BD2A_bRyy3Fkrphmj=VQ@mail.gmail.com>
Date: Fri, 22 Jul 2011 09:47:31 -0400
Message-ID: <CAP992=FCQ4uLBw5RWsBjEy-ayZDKkzs4A3j4U37x1n=ZNbwb1A@mail.gmail.com>
From: David Endicott <dendicott@gmail.com>
To: Dave Cridland <dave@cridland.net>
Content-Type: multipart/alternative; boundary="0016364d2c791977f404a8a8b552"
Cc: Server-Initiated HTTP <hybi@ietf.org>, IETF-Discussion <ietf@ietf.org>
Subject: Re: [hybi] Last Call: <draft-ietf-hybi-thewebsocketprotocol-10.txt> (The WebSocket protocol) to Proposed Standard
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Fri, 22 Jul 2011 13:47:40 -0000
serves the Javascript that opens the WS should remain constant. If WS > resolves the host/domain to a different address than the HTTP it was >>> spawned >>> from, it becomes a method to bypass same-origin / CORS restrictions. >>> >> >> That's an unfortunate misunderstanding. >> >> All protocols that use SRV records maintain the target domain. >> >> So a ws://example.com/xyz would still send a Host header of "example.com", >> whether SRV or not, so there is no impact on same origin policy, CORS, etc. >> >> > Good to know, thank you. Actually....I wasn't talking about the Host: header - that is totally spoofable...I was concerned about: 1. Browser client resolves example.com via old style DNS to x.x.x.x and fetches HTTP 2. Received HTML starts JS which starts WS connection 3. WS resolves example.com via DNS SRV to y.y.y.y and opens 4. WS now has access outside origin. Please note, I did not specify why DNS SRV resolved differently than old style DNS - could be malicious, could be an simple mistake. I am assuming the DNS SRV and old DNS might be answered from different servers. Do browsers restrict origin / cross-site access based on name or on address?
- [hybi] Last Call: <draft-ietf-hybi-thewebsocketpr… The IESG
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Thomson, Martin
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Julian Reschke
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Julian Reschke
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Julian Reschke
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Julian Reschke
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Francis Brosnan Blazquez
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Thomson, Martin
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Greg Wilkins
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Len Holgate
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Len Holgate
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Francis Brosnan Blazquez
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Len Holgate
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Francis Brosnan Blazquez
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Barry Leiba
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Len Holgate
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Francis Brosnan Blazquez
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mykyta Yevstifeyev
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Philippe Bernard
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Bruce Atherton
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Bruce Atherton
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Gabriel Montenegro
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… John Tamplin
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Greg Wilkins
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… David Endicott
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Roy T. Fielding
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Ted Hardie
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Keith Moore
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… John Tamplin
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Patrick McManus
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Alexey Melnikov
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Roy T. Fielding
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Roy T. Fielding
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Bjoern Hoehrmann
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Patrick McManus
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… John Tamplin
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Keith Moore
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Keith Moore
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Martin Rex
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Willy Tarreau
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Peter Saint-Andre
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Dave Cridland
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Mark Andrews
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Martin Rex
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Philip Homburg
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Roy T. Fielding
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Hector
- Re: [hybi] Last Call: <draft-ietf-hybi-thewebsock… Iñaki Baz Castillo
- [hybi] IESG note?, was: Last Call: <draft-ietf-hy… Julian Reschke
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Julian Reschke
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Roy T. Fielding
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Joel Martin
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Willy Tarreau
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Joel Martin
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Sylvain Hellegouarch
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Joel Martin
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Sylvain Hellegouarch
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Julian Reschke
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Peter Saint-Andre
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Richard L. Barnes
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Greg Longtin
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Willy Tarreau
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Roy T. Fielding
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Willy Tarreau
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Gabriel Montenegro
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Stephen Farrell
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Willy Tarreau
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Richard L. Barnes
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… John Tamplin
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… SM
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Stephen Farrell
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Peter Saint-Andre
- Re: [hybi] IESG note?, was: Last Call: <draft-iet… Willy Tarreau