Re: [hybi] Comments about draft-13

[Bjoern Hoehrmann <[e-mail]>]

* Richard L. Barnes wrote:
>I wouldn't have a problem with this had W3C not assigned a semantic to
>the field name:
>"
>[Do not allow a script to set a header] if /header/ is a case-insensitive
>match for one of the following headers [...] or if the start of /header/
>is a case-insensitive match for Proxy- or Sec- (including when header is
>just Proxy- or Sec-).
>"
><http://www.w3.org/TR/XMLHttpRequest/>

This is an incorrect reading of the XMLHttpRequest proposal. The idea is
that those header values must be controlled by the entity that puts the
bits on the wire, not the caller of XMLHttpRequest methods. It could say
just aswell that when the XMLHttpRequest caller sets the Content-Length
header, the implementation must override or remove the value when making
the request, as would be appropriate for the request. "A script" can of
course control the value of the header by sending so and so many bytes
(provided the length is indicated by the browser using the header). And
that is just XMLHttpRequest anyway, not the Websocket API.

Turning this around, you are saying that XMLHttpRequest callers should
be able to set the Websocket header on ordinary HTTP requests despite
them having no meaning there. Back in the day I argued to explain this
in the terms above, and the proposal does say "Note: The above headers
are controlled by the user agent to let it control those aspects of
transport. This guarantees data integrity to some extent. Header names
starting with Sec- are not allowed to be set to allow new headers to be
minted that are guaranteed not to come from XMLHttpRequest." at least.

"A script" is different from "not from XMLHttpRequest", so I am unclear
on where the confusion comes from. That it is XMLHttpRequest that makes
such conventions is a problem; I expect that the httpbis Working Group
<http://lists.w3.org/Archives/Public/ietf-http-wg/2011JanMar/0160.html>
where I raised it will resolve this in one form or another eventually.
-- 
Björn Höhrmann · mailto:[e-mail] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: [phone] · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/