Re: [hybi] Extensibility mechanisms?

[Adam Barth <[e-mail]>]

On Thu, Jul 22, 2010 at 1:04 PM, Scott Ferguson <[e-mail]> wrote:
> The issue is the number of request/response before the initial payload is
> sent. If we require the client to wait to validate the server before it can
> send its payload, the initial performance will be slower than a HTTP POST.
>
> That delay may be perfectly acceptable, but some people have raised it as an
> issue in the group. I'm fine with the delay myself, but I think it should be
> resolved.

We need to know the server understands web sockets before spamming
them with attacker-controlled bytes.  If we don't, we'll repeat the
long and tragic history of cross-protocol vulnerabilities caused by
HTTP POST.

This is a hard requirement.

Adam