Re: [hybi] Concerns about Origin

[Zhong Yu <[e-mail]>]

I agree. The spec should *require* servers to actively check Origin
and reject handshake immediately if Origin isn't accepted, instead of
allowing servers to defer that logic to clients.

APIs for server apps should have a hook to the handshake event, so
that apps can participate in the handshake. Apps have an opportunity
here to check Origin, set cookies, etc. per connection.

"Same origin" policy probably would be the most popular/default
policy. A simple and safe way to implement that on server side is to
match "Origin" with "Host" header(or the host part of the ws resource
URI).

That is safe if we assume that all pages on the Host can be trusted.
Cookies don't assume that, they have an additional "path" restriction.
If a WS app is as paranoid, currently it doesn't have a way to know on
which page specifically the connection is made. The app can add its
own anti XSRF measure like what we have to do for HTTP but that's not
too easy.

- Zhong Yu