Subject: [hybi] Server-side requirements in draft 10

From: "Joonas Lehtolahti" <[email-masked]>
Date: Sun, 07 Aug 2011 17:35:55 +0300

In draft-ietf-hybi-thewebsocketprotocol-10 in Server-side Requirements  
(section 5.2.), and more specifically subsection 5.2.1. Reading the  
Client's Opening Handshake, I noticed that the requirements do not list  
that the client's handshake must contain the upgrade headers (Upgrade:  
websocket, Connection: upgrade).

Based on that, even though it is required for the client to send those  
headers, it is not necessary for the server to see those headers to still  
consider the connection attempt as a valid WebSocket handshake as long as  
it has the other required parts such as Sec-WebSocket-Protocol. This would  
allow the server to complete the handshake and ask for protocol upgrade  
without the client requesting for upgrade. In other words even if the  
client violated the spec for handshake, the server would still accept it.

Is this an oversight or actually intentional? As far as I understood from  
RFC2616 (HTTP/1.1) the Upgrade header from server can only be sent in  
response to client indicating willingness to upgrade protocols. Therefore  
accepting a HTTP request without Upgrade headers as a valid WebSocket  
handshake and then responding with server handshake including the Upgrade  
headers would be violating the idea behind the headers in my opinion (I  
did not see the HTTP spec actually forbidding server from sending Upgrade  
headers without client requesting it, but it seems implicit it should not  
happen).

---

From: Salvatore Loreto <[email-masked]>
Date: Fri, 12 Aug 2011 16:12:18 +0300

On 8/7/11 5:35 PM, Joonas Lehtolahti wrote:
> Is this an oversight or actually intentional?
thanks for the good catch,
it is an oversight!

> As far as I understood from
exactly.

cheers
/Sal

-- 
Salvatore Loreto
www.sloreto.com

---

From: Alexey Melnikov <[email-masked]>
Date: Tue, 30 Aug 2011 14:41:57 +0100

Hi Joonas,

Joonas Lehtolahti wrote:

> In draft-ietf-hybi-thewebsocketprotocol-10 in Server-side 
> Requirements  (section 5.2.), and more specifically subsection 5.2.1. 
> Reading the  Client's Opening Handshake, I noticed that the 
> requirements do not list  that the client's handshake must contain the 
> upgrade headers (Upgrade:  websocket, Connection: upgrade).
>
> Based on that, even though it is required for the client to send 
> those  headers, it is not necessary for the server to see those 
> headers to still  consider the connection attempt as a valid WebSocket 
> handshake as long as  it has the other required parts such as 
> Sec-WebSocket-Protocol. This would  allow the server to complete the 
> handshake and ask for protocol upgrade  without the client requesting 
> for upgrade. In other words even if the  client violated the spec for 
> handshake, the server would still accept it.
>

This is an oversight, fixed in my copy of the document.

> As far as I understood from  RFC2616 (HTTP/1.1) the Upgrade header 
> from server can only be sent in  response to client indicating 
> willingness to upgrade protocols. Therefore  accepting a HTTP request 
> without Upgrade headers as a valid WebSocket  handshake and then 
> responding with server handshake including the Upgrade  headers would 
> be violating the idea behind the headers in my opinion (I  did not see 
> the HTTP spec actually forbidding server from sending Upgrade  headers 
> without client requesting it, but it seems implicit it should not  
> happen).