Re: [hybi] Handshake was: The WebSocket protocol issues.

[Willy Tarreau <[e-mail]>]

On Wed, Sep 29, 2010 at 12:33:05PM -0700, Maciej Stachowiak wrote:
> > Except that you have the Upgrade header which requires a 101 in
> > response. A normal HTTP server will either :
> >  - ignore the Upgarde and return a classical code (200, 404, 403, ...)
> >  - consider the Upgrade header and either return 101 because it matches
> >    the protocol it supports (WebSocket) or return an error code because
> >    it does not support the WS protocol.
> 
> A standalone WebSocket server may well ignore the presence/absence of the Upgrade header, since performing the rest of the handshake does not depend on it in any way. Since checking it is not technologically required, it's likely some servers won't check it.

OK now I see your point. However I disagree with the need to protect
such a broken implementation. We're back to the "and what if the
server-side implementation is buggy ?". A publicly accessible server
returning 101 to random requests will just get tons of unwanted requests
from random HTTP scans which will cause it major trouble anyway. The
presence of the Upgrade header *is* the only element that can dictate
a valid response. However I agree that the handshake should ensure
that a client can quickly escape from such a broken implementation,
the same way as right now a browser should reject responses which do
not look like HTTP.

Regards,
Willy