Re: [hybi] Handshake was: The WebSocket protocol issues.

[Greg Wilkins <[e-mail]>]

On 9 October 2010 11:43, Adam Barth <[e-mail]> wrote:
> I don't know why you think that's so hard to set the response status.
> There's a PHP function does exactly that:

Interesting - I tested it with apache2 and it does allow 1xx
responses, even though they are not actually legal HTTP, specially to
send 1xx responses with message bodies.

But that's why we have defence in depth.

I tried to spoof the content-length, but apache corrected the wrong
value so that all the content the php script provided was sent as the
body of the 101 response.

Also my attempts to send a null character resulted in 501 Method Not
Implemented responses and a closed connection.


>  We should just use that instead of crossing our fingers and hoping for the best.

Your attitude that you are the only one here that cares about security
is getter rather tiresome.