Re: [hybi] Handshake was: The WebSocket protocol issues.

[Scott Ferguson <[e-mail]>]

Bjoern Hoehrmann wrote:
> I am not sure you understood Adam's point. Right now an attacker cannot
> trick some person into opening a web page where the browser will then
> open a TCP connection to a host and port of the attackers choosing and
> have it send "WEBSOCKET ..." to it, and there may be environments and
> protocols where that allows some form of attack. Since the attacker has
> a good amount of control over the path that follows the verb, that's not
> entirely impossible and should be considered if the group decides to use
> a "WEBSOCKET" method.
>   

Right, but that's balanced against the added value of enabling servers 
to identify and reject a websocket request quickly.

The issue, of course, is that we're talking about different servers when 
evaluating the tradeoff. But I don't think Adam's point about the known 
problems with existing non-validating servers is a sufficient reason to 
weaken security for validating servers and future protocols.

-- Scott