Re: [hybi] Supporting OAUTH-like authentication?

[Iñaki Baz Castillo <[e-mail]>]

2011/8/12 Brian <[e-mail]>:
> This seems like a discussion for the JS API to me.  The protocol spec
> already explicitly allows arbitrary HTTP headers to be both sent and
> received by the WebSocket server and client, if I recall correctly.  The
> only thing preventing usage of this feature is a limitation in the
> JavaScript API.  I don't think there's any reason to disallow arbitrary
> headers being set on the WS handshake using exactly the same
> mechanism/restrictions as we do today for XHR.

> But what does that have to do with HyBi?

This is like asking "what does Digest authentication have to do with
SIP protocol?", or "what does _XMPP_authentication_mechanism_ have to
do with XMPP protocol?".

Maybe you prefer to see WebSocket as a "transport" protocol, but it's
an application protocol, and it's not crazy *at all* to expect that an
application protocol implements an authentication mechanism. But
probably, given the ugly HTTP jungle, many people from HTTP world
assume that authentication must exist in user layer, based on ugly
HTML forms which require rendering a web page in the client.

-- 
Iñaki Baz Castillo
<[e-mail]>