Subject: Re: [hybi] How are Cookies added?

From: Willy Tarreau <[email-masked]>
Date: Tue, 1 Nov 2011 08:29:19 +0100

Hi Iñaki,

On Mon, Oct 31, 2011 at 08:20:02PM +0100, Iñaki Baz Castillo wrote:
> Must I assume that Cookies will just be added (and automatically
> added) to the HTTP GET in case the URL of the WebSocket URI matches
> the domain of a previously visited web page?
> 
> I hope the answer is "not", but given the nature of WebSocket I expect
> this is the only way, so this stuf will force me to use the same
> domain for the Web server and the WebSocket server (and then use all
> that funny HTTP stuf like undefined proxies, load-balancers and so).
> Please tell me that I'm wrong.

What's wrong with having a websocket server under the same domain as
the web server ? At some point you want the code running in browsers
to be able to tell whether to send or not sensitive data to some site,
and domains are what's used to determine if cookies must be sent.

You could for instance have www.yourdomain.com and ws.yourdomain.com
and use a cookie valid on ".yourdomain.com". I don't see why that would
make you use proxies or load balancers.

Regards,
Willy

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Tue, 1 Nov 2011 13:19:08 +0100

> make you use proxies or load balancers.

Hi Willy, thanks a lot for your response. What worries me is the fact
that WebSocket just define a built-in authentication mechanism (the
"Cookie") and this is just valid when the web server and the websocket
server belong to the same "website" or provider, so I cannot build me
own page and include a JS from an external provider in which a
WebSocket connection takes place with such external provider. Well, I
can do it but I cannot pass a Cookie so the authentication must be
done within the WebSocket Subprotocol.

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: John Tamplin <[email-masked]>
Date: Tue, 1 Nov 2011 09:34:50 -0400

> done within the WebSocket Subprotocol.

So you would propose sending every cookie to every server, just in case it
might be related to this server request?  That seems both a security
problem and horribly inefficient.

If it is really a third-party server, you probably want something designed
for that like OAuth (as has been discussed here previously).

-- 
John A. Tamplin
Software Engineer (GWT), Google

---

From: Greg Wilkins <[email-masked]>
Date: Fri, 4 Nov 2011 10:27:00 +1100

Inaki,

If you want to do cross site authentication and authorisation, then
cookies are not the mechanism you should use - at least not on their
own.

You will need to look to something like OAUTH to create token that can
be passed either in URL, or in a prior HTTP request that will set a
cookie that can then be used by WS.

This is no different than for normal Ajax websites/mashups.

cheers

On 1 November 2011 23:19, Iñaki Baz Castillo <[email-masked]> wrote:
> _______________________________________________
> hybi mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/hybi
>

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Fri, 4 Nov 2011 10:28:42 +0100

> cookie that can then be used by WS.

Thanks Greg.

> This is no different than for normal Ajax websites/mashups.

But AJAX does not allow to contact a HTTP server different than the
domain from which the JS is downloaded, am I wrong?

-- 
Iñaki Baz Castillo
<[email-masked]>

---

From: John Tamplin <[email-masked]>
Date: Fri, 4 Nov 2011 10:27:17 -0400

> domain from which the JS is downloaded, am I wrong?

See CORS.

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Sat, 5 Nov 2011 14:45:12 +0100

>> domain from which the JS is downloaded, am I wrong?

Thanks, I missed that.

-- 
Iñaki Baz Castillo
<[email-masked]>