IETF Logo Mail Archive

Re: [hybi] draft-10 questions

Patrick McManus <pmcmanus@mozilla.com> Mon, 01 August 2011 12:37 UTC

Return-Path: <pmcmanus@mozilla.com>
X-Original-To: hybi@ietfa.amsl.com
Delivered-To: hybi@ietfa.amsl.com
Received: from localhost (localhost [127.0.0.1]) by ietfa.amsl.com (Postfix) with ESMTP id 60F0611E8393 for <hybi@ietfa.amsl.com>; Mon, 1 Aug 2011 05:37:57 -0700 (PDT)
X-Virus-Scanned: amavisd-new at amsl.com
X-Spam-Flag: NO
X-Spam-Score: -2.539
X-Spam-Level:
X-Spam-Status: No, score=-2.539 tagged_above=-999 required=5 tests=[AWL=0.060, BAYES_00=-2.599]
Received: from mail.ietf.org ([64.170.98.30]) by localhost (ietfa.amsl.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id Bfw1ghEBuJ-R for <hybi@ietfa.amsl.com>; Mon, 1 Aug 2011 05:37:57 -0700 (PDT)
Received: from linode.ducksong.com (linode.ducksong.com [64.22.125.164]) by ietfa.amsl.com (Postfix) with ESMTP id 92B0511E8218 for <hybi@ietf.org>; Mon, 1 Aug 2011 05:37:34 -0700 (PDT)
Received: by linode.ducksong.com (Postfix, from userid 1000) id C8E8010194; Mon, 1 Aug 2011 08:37:39 -0400 (EDT)
Received: from [192.168.16.226] (cpe-67-253-92-25.maine.res.rr.com [67.253.92.25]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by linode.ducksong.com (Postfix) with ESMTPSA id 6FD3610190; Mon, 1 Aug 2011 08:37:31 -0400 (EDT)
From: Patrick McManus <pmcmanus@mozilla.com>
To: Tobias Oberstein <tobias.oberstein@tavendo.de>
In-Reply-To: <634914A010D0B943A035D226786325D422BDDCE1D2@EXVMBX020-12.exch020.serverdata.net>
References: <634914A010D0B943A035D226786325D422BDDCE1C9@EXVMBX020-12.exch020.serverdata.net> <1312128157.1862.296.camel@ds9> <634914A010D0B943A035D226786325D422BDDCE1D2@EXVMBX020-12.exch020.serverdata.net>
Content-Type: text/plain; charset="UTF-8"
Date: Mon, 01 Aug 2011 08:37:22 -0400
Message-ID: <1312202242.1862.307.camel@ds9>
Mime-Version: 1.0
X-Mailer: Evolution 2.32.2
Content-Transfer-Encoding: 7bit
Cc: "hybi@ietf.org" <hybi@ietf.org>
Subject: Re: [hybi] draft-10 questions
X-BeenThere: hybi@ietf.org
X-Mailman-Version: 2.1.12
Precedence: list
List-Id: Server-Initiated HTTP <hybi.ietf.org>
List-Unsubscribe: <https://www.ietf.org/mailman/options/hybi>, <mailto:hybi-request@ietf.org?subject=unsubscribe>
List-Archive: <http://www.ietf.org/mail-archive/web/hybi>
List-Post: <mailto:hybi@ietf.org>
List-Help: <mailto:hybi-request@ietf.org?subject=help>
List-Subscribe: <https://www.ietf.org/mailman/listinfo/hybi>, <mailto:hybi-request@ietf.org?subject=subscribe>
X-List-Received-Date: Mon, 01 Aug 2011 12:37:57 -0000

On Sun, 2011-07-31 at 10:12 -0700, Tobias Oberstein wrote:

> 
> just to be sure to get that right:
> 
> A js served to a browser from http://somehost:80 can contact _any_ ws(s)://XXX:YYY ?
> 
> It's at the sole discretion of that other host to accept (depending e.g. on ws-origin) the ws ?
> 
> so for WebSockets in browsers, the "same origin policy" does not apply at all?

yes. Same origin is not necessary because websockets contains a
mandatory origin header and, thanks to the hash based handshake, we know
the server implements the spec that understands that semantic.

> e.g. under what circumstances will a cookie A set by the original js serving http://somehost:80 be
> delivered in the headers of an ws outgoing from that js?
> 
> or, is that browser implementation dependent?
> 

It certainly isn't specified by hybi :). In FF the normal HTTP cookie
rules apply (which is to say the most interesting factor is the hostname
of the ws server), because wherever we can we treat that handshake like
just another http transaction. 

That also means things like HSTS (will) apply to the handshake. CSP too
when that mapping is figured out.

One distinction we have decided to draw is to prevent downgrading mixed
content with websockets (i.e. you cannot connect to a ws:// url from a
https:// based context).

v2.23.0 | Report a Bug | By Email