Re: [hybi] CONNECT handshake text

[Dave Cridland <[e-mail]>]

On Tue Dec  7 21:52:35 2010, John Tamplin wrote:
> On Tue, Dec 7, 2010 at 4:42 PM, Dave Cridland <[e-mail]>  
> wrote:
> > C->S [Upgrade]
> > S->C [101]
> > C->S [Pseudo-CONNECT]
> 
> I assume the server has to receive the Pseudo-CONNECT before it can
> send user frames, right?  So, I would argue that this adds "half" a
> round trip.
> 
> Also, we have discussed Hello frames to verify that the connection  
> is
> up and that we can exchange WebSocket frames -- it seems like it  
> would
> be safe to send a S->C hello immediately after the 101 response (as  
> it
> would contain no attacker-controlled bytes).  It doesn't verify that
> the Pseudo-CONNECT was correctly processed, but you can't get that
> without adding another round trip.

Right, I think you can keep it to one round-trip, since the CONNECT  
only has to occur prior to C->S frames, not be received prior to S->C  
frames.

But also, the "Am I talking to a websocket-aware server" is  
controlled by the response to the upgrade, the CONNECT itself is  
really only there to minimize the risk of the attacks described in  
Adam's paper, it's no longer serving double-duty as the primary  
websocket handshake.

Dave.
-- 
Dave Cridland - mailto:[e-mail] - xmpp:[e-mail]
  - acap://acap.dave.cridland.net/byowner/user/dwd/bookmarks/
  - http://dave.cridland.net/
Infotrope Polymer - ACAP, IMAP, ESMTP, and Lemonade