Re: [hybi] requirement draft as wg item

[Maciej Stachowiak <[e-mail]>]

On May 12, 2010, at 12:00 AM, Thomson, Martin wrote:

> Reading through this, it would be easier to maintain if the requirements were numbered separately by section:
> 
> E.g. C1, C2 for client, S1, S2, S3 for server, X1, X2 for security.

Sounds like a good change. Does anyone object?


> Regarding the following security requirement: 
> 
>   REQ. 17:  The WebSocket Protocol MUST use the Origin-based security
>      model commonly used by Web browsers to restrict which Web pages
>      can contact a WebSocket sever when the WebSocket protocol is used
>      from a Web page.
> 
> It seems that _using_ this model is not what the protocol does.  "Supporting" might be a better choice.  The attacks that are foiled by the same model are foiled by the browser and its security policy, not the protocol.  Same comment for the next requirement.

Instead of "use" or "support" I think the right verb phrase would be "MUST work with" or "MUST be compatible with". It's a matter of fitting into the model. It's not clear what it means to use or suport it.

> 
> I'm still not satisfied by the discussion on protocol mimickry.  That needs a much longer explanation than the one given.  Also, this:
> 
>   REQ. 19:  WebSocket should be designed to be robust against cross-
>      protocol attacks.  The protocol design should consider and
>      mitigate the risk presented by WebSocket clients to existing
>      servers (including HTTP servers).  It should also consider and
>      mitigate the risk to WebSocket servers presented by clients for
>      other protocols (including HTTP).
> 
> Could be more simply worded as two requirements:
> 
>  REQ X-.  An HTTP request MUST be difficult for a WebSocket server to mistake for a WebSocket handshake.
> 
> With much more explanation.  A simple scenario (as Ian provided me recently) would go a long way.  Similarly:
> 
>  REQ X-. A WebSocket handshake MUST be difficult for an HTTP server to mistake for a valid HTTP request.
> 
> ...with a similar degree of justification.  (Random thought: requiring Content-Length: 0 might be a price worth paying here.)

Splitting it into two requirements is reasonable, but I think something more like the original wording will be easier for security reviewers to understand.

Regards,
Maciej