Subject: [hybi] Question about Sec-WebSocket-Accept paragraph

From: Joel Martin <[email-masked]>
Date: Thu, 16 Jun 2011 10:56:13 -0500

Sorry for the bogus subject in the previous post.

On Thu, Jun 16, 2011 at 10:54 AM, Joel Martin <[email-masked]> wrote:

> I started to try and answer this StackOverflow question about the protocol
> text and realized that I didn't understand it as well as I thought:
>
> http://stackoverflow.com/questions/6372252/why-does-the-server-in-a-websocket-request-have-to-answer-a-challenge
>
> The question is related to this paragraph (which has been in the drafts for
> a while unchanged):
>
>     Finally, the server has to prove to the client that it received the
>     client's WebSocket handshake, so that the server doesn't accept
>     connections that are not WebSocket connections.  This prevents an
>     attacker from tricking a WebSocket server by sending it carefully-
>     crafted packets using |XMLHttpRequest| or a |form| submission.
>
> I can see how the Sec-WebSocket-Accept would prevent a WebSocket client
> from being tricked into connecting to a non-WebSocket server. However, I'm
> having difficulty understanding how the Sec-WebSocket-Accept header would
> prevent a XMLHttpRequest from succeeding to a WebSockets server since it is
> sent from the server. I am aware of the prohibition against "Sec-" headers
> in the client to server direction. Is there a requirement that
> XMLHttpRequest responses with unrecognized "Sec-" headers be rejected by
> user agents (and if so does this only apply in the browser case)?
>
> It's likely I just don't have enough context to understand the paragraph,
> but perhaps it could be clarified a bit.
>
> Regards,
>
> Joel Martin
>

---

From: Ian Fette (イアンフェッティ) <[email-masked]>
Date: Thu, 16 Jun 2011 09:50:28 -0700

I just replied on your other post...

On Thu, Jun 16, 2011 at 8:56 AM, Joel Martin <[email-masked]> wrote:

> On Thu, Jun 16, 2011 at 10:54 AM, Joel Martin <[email-masked]>wrote:
>
>> The question is related to this paragraph (which has been in the drafts
>> for a while unchanged):
>>
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>
>