Subject: Re: [hybi] draft-10 questions

From: Patrick McManus <[email-masked]>
Date: Mon, 01 Aug 2011 08:37:22 -0400

On Sun, 2011-07-31 at 10:12 -0700, Tobias Oberstein wrote:

> 
> just to be sure to get that right:
> 
> A js served to a browser from http://somehost:80 can contact _any_ ws(s)://XXX:YYY ?
> 
> It's at the sole discretion of that other host to accept (depending e.g. on ws-origin) the ws ?
> 
> so for WebSockets in browsers, the "same origin policy" does not apply at all?

yes. Same origin is not necessary because websockets contains a
mandatory origin header and, thanks to the hash based handshake, we know
the server implements the spec that understands that semantic.

> e.g. under what circumstances will a cookie A set by the original js serving http://somehost:80 be
> delivered in the headers of an ws outgoing from that js?
> 
> or, is that browser implementation dependent?
> 

It certainly isn't specified by hybi :). In FF the normal HTTP cookie
rules apply (which is to say the most interesting factor is the hostname
of the ws server), because wherever we can we treat that handshake like
just another http transaction. 

That also means things like HSTS (will) apply to the handshake. CSP too
when that mapping is figured out.

One distinction we have decided to draw is to prevent downgrading mixed
content with websockets (i.e. you cannot connect to a ws:// url from a
https:// based context).

---

From: Tobias Oberstein <[email-masked]>
Date: Mon, 1 Aug 2011 06:56:02 -0700

thanks for your explanations. interesting.

==
 
1 more unrelated question regarding the draft:

The spec says "all client-to-server frames MUST be masked".

Does that also apply to frames of payload length 0?

For example, here a real-world client-to-server close frame I've seen:

888024193821

It includes a mask, but no payload.

In other words, what of the following options is meant:

A)
All client-to-server frames MUST be masked, regardless whether payload length > 0 or = 0.
 
B)
All client-to-server frames, when having payload length > 0 MUST be masked, when having payload length = 0 MAY be masked.

C)
All client-to-server frames, when having payload length > 0 MUST be masked, when having payload length = 0 MUST NOT be masked.

??

An analog question is: what about server-to-client frames.

Those MAY be masked.

But, again, what about frames of payload length 0? Mask forbidden or optional?

---

From: John Tamplin <[email-masked]>
Date: Mon, 1 Aug 2011 10:05:02 -0400

> Does that also apply to frames of payload length 0?

There is no exclusion and "all" would seem to include them, so yes.

You could argue it is not useful, though I don't know that the number of
empty-payload messages is going to be high enough to justify additional
complexity in implementations.

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: Tobias Oberstein <[email-masked]>
Date: Mon, 1 Aug 2011 07:24:41 -0700

> There is no exclusion and "all" would seem to include them, so yes.

thanks for reassurance

>
> You could argue it is not useful, though I don't know that the number of empty-payload messages is going to be high enough to justify additional complexity in implementations.

yep, as my impression is that WebSockets is concerned about wire volume, that was my trigger, but I wont argue, since
- pings for keep-alive are probably the only sensible use of empty payload frames
- masking empty-payload pings triples their volume, but
- the regular case would be the server pinging the client, not reverse