Re: [hybi] #1: HTTP Compliance

[Willy Tarreau <[e-mail]>]

On Wed, Jul 21, 2010 at 10:15:42AM -0400, John Tamplin wrote:
> > I don't think anyone has indicated a practical problem caused by the extra
> > bytes.
> >
> 
> I believe we have already had a real-world practical case where they did
> cause a problem:
> 
>    - client sends WebSocket request that goes through a proxy, random bytes
>    are not advertised in the Content-length
>    - proxy doesn't know WebSocket, passes along connection to real server
>    which does implement WebSocket
>    - server waits reading random bytes which were not forwarded
>    - server drops the connection after a timeout

Confirmed. And it will fail with any HTTP reverse-proxy. And if you manage
to make an HTTP reverse-proxy work with the current scheme, then this
rev-proxy can be tricked by the client into sending uncontrolled requests
to the server (by just setting the "Upgrade" option that the server will
ignore).

> Thus the random bytes did succeed in preventing a WebSocket connection
> across a non-WS compliant proxy, but:
> 
>    1. the proxy was actually capable of forwarding the connection if the
>    server had completed the request
>    2. we had to wait for a timeout, so this was not a fast-fail situation
>    3. the same thing could have been more easily accomplished by having a WS
>    control frame exchanged at startup with similar results without
>    non-compliant random bytes on the wire

And it would have worked without requiring any change to deployed components.

Regards,
Willy