Subject: [hybi] Message (not frame) sizes and the JavaScript API

From: Philipp Serafin <[email-masked]>
Date: Tue, 09 Aug 2011 21:58:09 +0200

Hello everyone,

recently there has been much discussion about both maximum lengths for
frames and for messages. If I understand it correctly, the main argument
against maximum lengths is that WS implementations could easily pass on
data to the application layer chunk-wise, via a streaming API.

However, right now, for the client side, the HTML5 websocket API
mandates that browsers that act as WS clients must buffer the whole
message and pass it on to the scripting layer only after it has been
fully received.

>From a web developer perspective, I think a message-based API is both a
lot easier to use and a lot more secure than a streaming API, therefore
it shouldn't be given up lightly.

However, consider e.g. a malicious website that sends an infinite stream
of fragments but never actually completes the message. I would like to
ask how a robust, conforming browser implementation is supposed to
behave in such a case, apart from consuming all available memory and
crashing. In order to implement a message-based API like the HTML5 JS
API, wouldn't you actually need a maximum message size?

Regards