Re: [hybi] I-D Action: draft-ietf-hybi-thewebsocketprotocol-13.txt

["Richard L. Barnes" <[e-mail]>]

> - clients are not required to accept masked frames, so the server MUST NOT
>  send masked frames. Whether clients accept or not masked frames has no
>  importance.
> 
> - In order to ensure intermediary protection, clients MUST mask outgoing
>  frames, and servers MUST NOT accept unmasked frames.

Let's not fool ourselves that having servers reject unmasked frames does anything about intermediary protection. 

If there's a WS stack out there that an attacker can force to send unmasked frames, then the game is already over.  The attacker just connects to a server under his control that will accept the unmasked frames, and the gig is up.


> However, it would be nice if we insist that those requirements are made for
> the public internet and are not a structural protocol requirement, so they
> MAY be adapted in very specific environments if there is any benefit from
> doing so.

In which case, you might as well make it a SHOULD, with an operational note that says that c2s masking is strongly RECOMMENDED.

--Richard