Re: [hybi] thewebsocketprotocol #4 (new): handshake does not work properly with HTTP reverse proxy.

["hybi issue tracker" <[e-mail]>]

#4: handshake does not work properly with HTTP reverse proxy.


Comment(by gregw@…):

 I proposed fix for this issue was proposed and discussed in the thread
 http://www.ietf.org/mail-archive/web/hybi/current/msg04148.html

 Specifically that:

 * The unframed random bytes should not be sent by the client after the
 upgrade request. Instead all the random bytes that represent a client
 generate nonce should be sent as hex encoded header values in the upgrade
 request.
 * The server should receive and handle the upgrade request as entirely a
 HTTP requests.  If the connection is acceptable, then a 101 response
 should be sent.
 * Immediately following the 101 response, the server must send a PING ws
 frame (alternately a new HELLO frame), that contains a hash of the client
 nonce plus a newly generated server nonce. The server will start a timeout
 waiting for a response.
 * The server may start sending WS frames after the PING, but must do so
 with knowledge that the handshake is not complete and the client may still
 reject it.
 * The client will receive the 101 response.
 * The client will receive the PING WS frame (or HELLO) and will check the
 value of the hashed client nonce.
 * The client will send a PONG response (or HELLO) containing a hash of the
 server nonce.
 * The client will call the onopen function of the related websocket API.
 The client may now send and receive WS frames.
 * The server will receive the PONG (or HELLO) response and will check the
 hashed server nonce in that frame.
 * The server will notify its local application that the handshake has
 completed.


 There were some objections to this proposal, but mostly focused on
 security issues. The result of the discussion around these objections is
 that a CONNECT based handshake may be proposed, plus further advocacy of
 TLS/NPN approaches.

 The proposed changes to the upgrade handshake were further discussed in
   http://www.ietf.org/mail-archive/web/hybi/current/msg04401.html

 Proposed diffs will be coming next.

-- 
-------------------------------------------+--------------------------------
 Reporter:  salvatore.loreto@…             |       Owner:     
     Type:  defect                         |      Status:  new
 Priority:  critical                       |   Milestone:     
Component:  thewebsocketprotocol           |     Version:     
 Severity:  Active WG Document             |    Keywords:     
-------------------------------------------+--------------------------------

Ticket URL: <http://trac.tools.ietf.org/wg/hybi/trac/ticket/4#comment:5>
hybi <http://tools.ietf.org/hybi/>
The Hypertext-Bidirectional (HyBi) working group will seek
standardization of one approach to maintain bidirectional
communications between the HTTP client, server and intermediate
entities, which will provide more efficiency compared to the current
use of hanging requests.