Re: [hybi] Comments about draft-13

[Greg Wilkins <[e-mail]>]

On 7 September 2011 07:27, Alexey Melnikov <[e-mail]> wrote:
> Richard L. Barnes wrote:
>
>> Also, to re-iterate a comment I made earlier, "Sec-Websocket-Protocol"
>> should just be "Websocket-Protocol", since it is not "Sec" -- scripts can
>> set the value pretty much directly.
>>
> Let's please not change the header field name now, this will break
> implementations of all earlier versions, some of which are already deployed.

I'm not really keen on changing the header either, but  not sure how
much of a transgression of the W3C rules it is to send a script
control value in a Sec- header.   Perhaps we should refer the question
to the W3C - if they don't view it as a big issue, then we can keep
it.

If we keep it and it is a big issue, then we will be forced to change
later and that will be more painful.

Note that if we are forced to change, then I think we should also
change all the server sent headers and remove Sec- from them, because
they obviously do not match the w3c criteria.


cheers