Subject: Re: [hybi] Refinement of draft upgrade handshake

From: Greg Wilkins <[email-masked]>
Date: Tue, 2 Nov 2010 12:38:48 +1100

Attached is an updated version of the -03 draft text and a context
diff of the changes that reflect the proposals expressed in this
thread for the refinement of the upgrade handshake.  Specifically:

A) Use WS Hello from the server and a WS Hello from the client WS
frames to transport hashed nonces (rather than unframed bytes). This
fixes the issue with intermediaries not forwarding the unframed bytes
on the wire and makes the handshake comply with the requirement to be
HTTP/1.1 compliant before the 101 response.

B) Include a server nonce in the server sent Hello, that the client
must hash and return in it's Hello.

C) Use a Hello frame type instead of ping/pong

D) Replace the char/space encoding of the client nonce with simple hex encoding.

E) Define tight restrictions on the punctuation that can be sent in ws
URLs and subprotocols (eg prohibit use of : ) so that they cannot be
used to inject headers.  While not as robust as encrypting the
handshakes, these restrictions will provide substantial protection
against user provided data being used as part of an attack.

F) Invert the framing MORE bit to be a FIN bit, so that WS control
frames will start with a non-ascii character

G) Change the "GET" to "WEBSOCKET" to allow admin authorization
control, and enable fast rejection.

regards