Re: [hybi] hybi Digest, Vol 51, Issue 14

[Takeshi Yoshino <[e-mail]>]

On Sun, Jun 2, 2013 at 2:55 AM, Scott Morgan <[e-mail]> wrote:

> On Tue, May 28, 2013 at 10:36 PM, Takeshi Yoshino <[e-mail]>wrote:
>
...

>  Could you elaborate?
>>
> Yes and actually I am going to change the way I do this after reading the
> rfc.   I am going to use regular http(s) for the authentication part so
> this would change to the following.
>
> 1 Browser sends authentication to the server over https
> 2 Server notes the ip address of the request and responds with a ws url to
> the client if successful ie.  wss://example.com/valid?session=123
> 3 Browser connects to url wss://example.com/valid?session=123
> 4 Server checks the ip address of the original https request with the wss
> connection
>     to make sure they are the same, and takes appropriate action (closes
> the wss connection if they are NOT, or some other appropriate action)
>

I see.


>  1 Browser connects to a wss server
>>> 2 User does some authentication (ie user id, password)
>>> 3 wss server does authentication using user id, password and ip address
>>> (for either some privileges or as a additional authentication parameter
>>> for a success fail style authentication)
>>>
>>
>> That is that only access from some IP address X will have some high
>> privilege?
>>
> Yes the ip address of the user may allow the user to gain additional
> privileges, ie something like;
> John logs in to the Bank from a public computer he can't do much, but see
> the accounts.
> John logs in from his office (and the office ips addresses are marked as
> secure locations)
>   he gets to transfer money
>
>
Sounds fine.


> Note my application is not a bank application, this is just a example.
>
>>
>>
>>>  4 after successful auth message at the browser an the wss connection
>>> is closed
>>>  and a different wss is opened on the same port with a different path in
>>> the url
>>> 5 The wss server only allows the different wss connection to open if
>>> there is a http session from the original wss connection from the same ip
>>> address of the first connection.
>>>
>>
>> Does the server get a session parameter over the new connection and also
>> check the source IP address? Or the server here just checks if there was
>> successful authentication on some prior connection with the same IP address
>> as the new one?
>>
> My main goal was to attempt to validate the IP address of the sender by
> comparing the ip address of multiple connections, (originally both wss, now
> https and wss).
>

Even without multiplexing, it's possible that both auth and application
traffic come over the same TCP connection. RFC 6455 doesn't prohibit using
the same TCP connection for HTTPS and WSS. It's not about multiplexing but
keep-alive. IIRC, it's still under discussion but technically you can do an
HTTPS for auth and then send WS handshake on the same connection.