Subject: [hybi] Serverside Sec-headers

From: Toni Ruottu <[email-masked]>
Date: Tue, 1 Mar 2011 14:35:17 +0200

hello

Why do WebSockets have Sec- headers on the server-side? I think all
headers should be accessible to the server even when it is untrusted
and running in a sandbox. I see no reason why any of the headers
should be hidden. The untrusted server side code should probably also
have access to Sec- headers, but maybe using Sec- prefix with the
server side headers is till sending the wrong message out to
implementors.

It does make sense for the platform to verify that the incoming
connection is a WebSocket connection before handing it over to
untrusted code. The platform should also decide the resource and port
that the untrusted server is allowed to use. This is the model we have
been using in our BrowserSocket experiments. See
http://browsersocket.org/ for details.

  --Toni