Re: [hybi] Handshake was: The WebSocket protocol issues.

[Willy Tarreau <[e-mail]>]

Adam,

I agreed with almost all what you said except that :

On Thu, Sep 30, 2010 at 09:04:50PM -0700, Adam Barth wrote:
> Well, once I get past the handshake, WebSockets gives me an almost
> unrestricted TCP connection to the target server.  If we weren't
> worried about what an attacker could do with unrestricted TCP
> connections to a server, we wouldn't need a handshake in the first
> place.

It's not an "almost unrestricted TCP connection to the target server",
but rather an "almost unlimited bidirectional connection to the
target application". You need the other end to speak WS frames, even
if you have to trick it for this. But you won't use that connection
for SSH for instance.

Willy