Re: [hybi] Handshake was: The WebSocket protocol issues.

[Alexander Voronin <[e-mail]>]

Intermediates and servers that have no WebSockets support will answer to
handshake with any code but no 101. Is that still not enough to figure out
if WebSocket connection established? Why to make things complex if they
could be simple?

Also I did not get this
article<http://www.ietf.org/mail-archive/web/hybi/current/msg04166.html>by
email, but will answer here. Referenced document provides sample of
cross-protocol attack using HTTP POST on SMTP. POST is a one-stage request
without handshake, WebSocket is a GET extension with handshake, so I guess
does not matter how complicated handshake will be if browser not obey HTTP
rules and continue HTTP session after getting "500 Command unrecognized"
instead of "HTTP/1.1 101 OK". This is not protocol but browser issue.

2010/9/24 John Tamplin <[e-mail]>

> On Fri, Sep 24, 2010 at 5:33 AM, Alexander Voronin
> <[e-mail]> wrote:
> > To my mind is enough to send 101 or 501 if websocket is not implemented
> on
> > server or intermediary. You are making things too complicated and
> implicit.
>
> The intermediaries we are concerned about have already been written.
> If they were going to be modified to send a 501 back for a WebSocket
> connection,  they might as well just be modified to support
> WebSockets.
>
> So, we want to let existing intermediaries that would currently work
> without change keep working (which means remaining HTTP compliant
> until the server response comes back), and hopefully detect those that
> fail quickly without requiring timeouts.
>
> --
> John A. Tamplin
> Software Engineer (GWT), Google
>



-- 
когда я опустился на самое дно, снизу мне постучали..