Re: [hybi] Handshake was: The WebSocket protocol issues.

[Willy Tarreau <[e-mail]>]

On Fri, Sep 24, 2010 at 06:08:31PM +0300, Alexander Voronin wrote:
> Let's see whats happen when we using WebSocket:
> 1. JavaScript creates socket
> 
> 
> var webSocket = new WebSocket('ws://localhost/echo');
> 
> 
> 2. Browser here can't send any kind of data, but just handshaking
> 
> GET /echo HTTP/1.1
> Upgrade: WebSocket
> Connection: Upgrade
> Host: example.com
> Origin: http://example.com
> WebSocket-Protocol: sample

Current version of the draft implies that the browser also sends 8 bytes
after that. And if we do things badly, the handshake could require sending
more bytes, thus becoming more dangerous. 

> ---
> 
> HTTP/1.1 101 Web Socket Protocol Handshake
> Upgrade: WebSocket
> Connection: Upgrade
> WebSocket-Origin: http://example.com
> WebSocket-Location: ws://example.com/demo
> WebSocket-Protocol <http://example.com/demoWebSocket-Protocol>: sample
>
> 3. Just now after browser GOT 101 and correct handshake data we can sand
> some data

We all agree about that, but as several people have indicated, this minimal
handshake requires two round trips because it still does not validate the
fact that the whole chain can exchange data in both directions. That's why
there are thoughts about improving from that point.

Regards,
Willy