Subject: [hybi] opening headers: multiplicity / port in host

From: Tobias Oberstein <[email-masked]>
Date: Sat, 29 Oct 2011 05:27:41 -0700

Polishing up our WS handshake code, I have 3 short questions regarding headers:

1)
The spec is explicit about the allowed header multiplicity in opening handshake requests and responses for the headers:

sec-websocket-key
sec-websocket-accept
sec-websocket-protocol
sec-websocket-extensions
sec-websocket-version

I couldn't find text mentioning multiplicity wrt:

origin (was: sec-websocket-origin)
host
connection
upgrade

Is the following right?

Host header MUST appear exactly once in request (by HTTP spec).

Origin header MUST NOT appear more than once in request (exactly once for browser clients).

Upgrade/Connection: may contain multiple (comma separated) values, may appear more than once (by HTTP spec).

2) Upgrade header multiplicity
 
Hybi-17:
"""
   5.   The request MUST contain an "Upgrade" header field whose value
        is equal to "websocket".

   6.   The request MUST contain a "Connection" header field whose value
        MUST include the "Upgrade" token.
"""

The HTTP spec seems to allow multiple values (and presumably also multiple headers)

Upgrade: HTTP/2.0, SHTTP/1.3, IRC/6.9, RTA/x11

So is it allowed for a WS client to send i.e.

Upgrade: WebSocket, RTA/x11

and the server accepts WS only, sending back

Upgrade: WebSocket

?

Note that the "Connection" header description in the spec has "extra language"
"MUST include the ... token", which seems to allow multiple values in a single
Connection header as well as multiple Connection headers.

Should the Upgrade header be treated the same?

3) Host header port?

Hybi-17:
"""
   4.   The request MUST contain a "Host" header field whose value is
        equal to /host/.
"""

It does not say "equal to /host/[:/port/]".

However, i.e. both Firefox and Chrome will send i.e.

Host: 127.0.0.1:9001

Are both forms allowed?

Host: /host/
Host: /host/:/port/

And if the client uses the 2nd, validate that /port/ is the one the server is listening on?

---

From: Julian Reschke <[email-masked]>
Date: Sat, 29 Oct 2011 14:55:03 +0200

> Host header MUST appear exactly once in request (by HTTP spec).

Yes. (well, unless it's HTTP/1.0)

> Upgrade/Connection: may contain multiple (comma separated) values, may appear more than once (by HTTP spec).

Yes.

> and the server accepts WS only, sending back

Yes.

> Should the Upgrade header be treated the same?

Yes, and this should be fixed during AUTH48.

> However, i.e. both Firefox and Chrome will send i.e.

No, the port is required unless it's the default.

> And if the client uses the 2nd, validate that /port/ is the one the server is listening on?

Yes.

That's another thing that should be fixed AUTH48. Also, it's what we 
deserve for trying to rephrase normative requirements from HTTP, instead 
of just referring to them.

Best regards, Julian

---

From: Joe Mason <[email-masked]>
Date: Mon, 31 Oct 2011 09:30:48 -0400

> -----Original Message-----

Are you sure?  The spec seems quite clear that "Upgrade" must exactly equal "websocket".  No multiple values allowed...

> Yes, and this should be fixed during AUTH48.

Oh.

Well, the server I wrote is wrong, then.

I think this change is big enough to need a version bump.  Anyone advertising itself as accepting WebSockets version 13 might only be able to handle exactly one upgrade value, since that's what the spec said for several versions.

Joe

---------------------------------------------------------------------
This transmission (including any attachments) may contain confidential information, privileged material (including material protected by the solicitor-client or other applicable privileges), or constitute non-public information. Any use of this information by anyone other than the intended recipient is prohibited. If you have received this transmission in error, please immediately reply to the sender and delete this information from your system. Use, dissemination, distribution, or reproduction of this transmission by unintended recipients is not authorized and may be unlawful.

---

From: Julian Reschke <[email-masked]>
Date: Mon, 31 Oct 2011 14:38:59 +0100

> Are you sure?  The spec seems quite clear that "Upgrade" must exactly equal "websocket".  No multiple values allowed...

Yes, I am sure. This is defined by HTTP, not by the Hybi spec.

 > ...

Best regards, Julian