Re: [hybi] Fwd: failed TLS handshake: which close code?

["Richard L. Barnes" <[e-mail]>]

Quoting the same part of the WS API spec as I did earlier:
"
If the user agent was required to fail the websocket connection or the WebSocket connection is closed with prejudice, fire a simple event named error at the WebSocket object.
"

A TLS failure requires the UA to fail the websocket connection, and should result in an error event, not a close event.  So it seems that Chrome and Firefox are not following the spec in this regard.

--Richard





On Oct 24, 2011, at 12:25 PM, Tobias Oberstein wrote:

>> This is pointless.  These codes are not needed by the WS API, since a TLS
>> failure does not provide a close code. 
> 
> Well, both Chrome (16.0.912.10 canary) and Firefox (10.0a1 (2011-10-24))
> _do_ fire the onclose() event handler with 1006 when the WS connection cannot
> even be established (host unreachable).
> 
> Firefox fires the onclose() with 1006 also for WSS when the server cert is invalid.
> Chrome currently does not check WSS server cert (unrelated beh./bug).
> 
> So both browsers are wrong?
> 
> Anyway: what is your recommendation for WS API for _apps_ (JavaScript) to recognize "invalid server cert"?
>