Re: [hybi] Extensibility mechanisms?

[John Tamplin <[e-mail]>]

On Thu, Jul 22, 2010 at 10:07 AM, Willy Tarreau <[e-mail]> wrote:

> > 1) Hostile JS code running in the browser may use the browser's WebSocket
> client code to try to attack existing HTTP resources, if it can make a
> request that looks sufficiently like HTTP.
>
> Maybe I'm mistaken, but why couldn't such JS code simply make use of the
> browser's HTTP client to do so ? Posting a form, reloading an image from
> a given URL or making an XMLHttpRequest seems perfectly possible right now,
> so trying to do that via the WebSocket code would bring nothing at all.


JS is limited in how it can influence all the HTTP headers in the request,
and is also bound by same-origin policy.


> > 3) Hostile JS code running in the browser may use the browser's HTTP
> client code (e.g. via XMLHttpRequest) to try to attack newly created
> WebSocket servers, if it can make a request that looks sufficiently like
> WebSocket.
>
> The same is true here : why would the JS code try to use the normal HTTP
> client if the browser supports WebSocket, with which the code would be
> able to have finer control over its attack ?


The JS cannot control anything but the data contents of the message, so is
limited in what it can do to the headers of the initial request or the
framing.

-- 
John A. Tamplin
Software Engineer (GWT), Google