Subject: [hybi] [Technical Errata Reported] RFC6455 (4398)

From: RFC Errata System <[email-masked]>
Date: Wed, 24 Jun 2015 01:36:37 -0700 (PDT)

The following errata report has been submitted for RFC6455,
"The WebSocket Protocol".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata_search.php?rfc=6455&eid=4398

--------------------------------------
Type: Technical
Reported by: Mike West <[email-masked]>

Section: 4.1

Original Text
-------------
1. The components of the WebSocket URI passed into this algorithm
   (/host/, /port/, /resource name/, and /secure/ flag) MUST be
   valid according to the specification of WebSocket URIs specified
   in Section 3.  If any of the components are invalid, the client
   MUST _Fail the WebSocket Connection_ and abort these steps.

Corrected Text
--------------
1. The components of the WebSocket URI passed into this algorithm
   (/host/, /port/, /resource name/, and /secure/ flag) MUST be
   valid according to the specification of WebSocket URIs specified
   in Section 3.  If any of the components are invalid, the client
   MUST _Fail the WebSocket Connection_ and abort these steps.

2. If secure is false, and the algorithm in Mixed Content's "§5.1
   Does settings object restrict mixed content?" returns Restricts
   Mixed Content when applied to client's entry script's relevant
   settings object's, then the client MUST fail the WebSocket
   connection and abort the connection.

Notes
-----
This change is suggested by the W3C's "Mixed Content" document (https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration), and will bring WebSockets' behaviors into line with XMLHttpRequest, EventSource, and Fetch, all of which act as though there was a network error when blocking a mixed content request, rather than throwing a SecurityError exception.

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party (IESG)
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
--------------------------------------
Title               : The WebSocket Protocol
Publication Date    : December 2011
Author(s)           : I. Fette, A. Melnikov
Category            : PROPOSED STANDARD
Source              : BiDirectional or Server-Initiated HTTP APP
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Barry Leiba <[email-masked]>
Date: Wed, 24 Jun 2015 09:09:14 -0300

This seems sensible, and seems like it ought to be "Held for Document
Update", yes?  Unless this truly is something that was meant to be in
the document originally, and was accidentally left out... which I
don't think is the case.

Barry

---

From: Mike West <[email-masked]>
Date: Wed, 24 Jun 2015 14:20:29 +0200

"Held for Document Update" is what I'm going for, yes. This isn't something
that was left out of the original document, but a change in the way mixed
content handling has been specified and implemented.

-mike

--
Mike West <[email-masked]>, @mikewest

Google Germany GmbH, Dienerstrasse 12, 80331 München,
Germany, Registergericht und -nummer: Hamburg, HRB 86891, Sitz der
Gesellschaft: Hamburg, Geschäftsführer: Graham Law, Christine Elizabeth
Flores
(Sorry; I'm legally required to add this exciting detail to emails. Bleh.)

On Wed, Jun 24, 2015 at 2:09 PM, Barry Leiba <[email-masked]>
wrote:

> > This change is suggested by the W3C's "Mixed Content" document (
> https://w3c.github.io/webappsec/specs/mixedcontent/#websockets-integration),
> and will bring WebSockets' behaviors into line with XMLHttpRequest,
> EventSource, and Fetch, all of which act as though there was a network
> error when blocking a mixed content request, rather than throwing a
> SecurityError exception.
> >
> > Instructions:
> > -------------

---

From: Alexey Melnikov <[email-masked]>
Date: Wed, 24 Jun 2015 14:34:14 +0100

> the document originally, and was accidentally left out... which I
Held for Document Update looks right to me.