Re: [hybi] Web Socket IP Authentication

[Hector Santos <[e-mail]>]

Good morning,

Dave Cridland wrote:
> On Thu Sep  2 22:30:04 2010, Hector Santos wrote:
>>
>> In any case, the point was that IP authentication *can* be a valid 
>> server side consideration for secondary web sockets connections.
>>
> And my point is that it is not.

Come on David, surely you are more open minded than that. :)

> An HTTP request may be passed through several proxies, 
> a WebSocket request is less likely to. 

Sure.

> One point you made does apply here too - an IP address, if within the AS 
> or local network, is sufficient to authenticate as an otherwise 
> anonymous local user. This is the case used to allow SMTP relaying to 
> ISP customers. I don't think this will be an option for the vast 
> majrotiy of WebSocket services.

Well, David, you already made a decision on what the majority services 
will be and to (mildly) suggest there is no utility for the minority 
cases. :)

We long had a dual/multi client session framework since 1996 so my 
perspective does have a basis. WebSocket offers an alternative, 
perhaps  simplified "client/wiring" framework. For us, its more about 
single sourcing the client interface devices - again. It may also show 
to be "not ready" for prime time.

Nonetheless, while off hand the session management will naturally 
carry over which is not IP associated, IP may|could be part of it. 3rd 
party applets have leveraged "IP" in different ways, i.e. "call back 
verifiers" ideas. Overall, the reasons have been more strategic in 
some aspect, but its all about different levels of session management 
considerations.

WebSocket simply highlights these design considerations more - at 
least for us.

IMO, the majority market place, at least in the short term, will be 
more transforming existing applications including private, intranet, 
etc.  The longer term may be more public service hosting, a wider mesh 
network or some combo of decentralization/centralization server ideas.

Thanks for your input.

-- 
Hector Santos, CTO
http://www.santronics.com
http://santronics.blogspot.com