Re: [hybi] [Editorial Errata Reported] RFC6455 (3473)

[Takeshi Yoshino <[e-mail]>]

FYI:

The text (without /port/) was introduced by Ian Hickson on this release
(April 2009).
http://tools.ietf.org/rfcdiff?url2=draft-hixie-thewebsocketprotocol-11.txt
MUST was added to the sentence by bulk addition of MUSTs/SHOULDs on this
release. Even before this was specified as MUST indirectly by the
introduction text for this algorithm.
http://tools.ietf.org/rfcdiff?url2=draft-ietf-hybi-thewebsocketprotocol-04.txt

/port/ was added on this release. I couldn't find discussion led to this
change on the list.
http://tools.ietf.org/rfcdiff?url2=draft-ietf-hybi-thewebsocketprotocol-07.txt


On Fri, Feb 1, 2013 at 11:27 PM, Martin Thomson <[e-mail]>wrote:

> Is this "host and port" or "IP and port" ?  That too is unclear.  If
>

Yes... /host/ in the spec is not always IP address. According to hixie-11,
it was intended to mean IP and he added the text "even if the remote host
is known by another name" (I'm not saying everybody in HyBi later agreed
with the text interpreting it that way).


> I'm sharding a.example.com and b.example.com and they are served on
> the same VIP, is the expectation that wss://a.example.com/ and
> wss://b.example.com/ can't have concurrent connection attempts?


I think we should do so (no concurrent connection to a.example.com and
b.example.com). Throttling based on domain name / port pair might make
sense if a.example.com and b.example.com has different backends as you said
and the LB having the VIP has much more processing power than backends. But
as anybody can have A record pointing to the IP address (x.x.x.x) of
a.example.com, an attacker can prepare a.attacker.com, b.attacker.com, ...
pointing to x.x.x.x and feed a script connecting to ws://a.attacker.com,
... to bypass the throttling (domain name based).