Subject: Re: [hybi] Comments on draft-ietf-hybi-thewebsocketprotocol-02

From: Dave Thaler <[email-masked]>
Date: Mon, 18 Oct 2010 20:25:38 +0000

I looked at draft-ietf-hybi-thewebsocketprotocol-03 and it looks like almost all of my
comments still apply (i.e., have not been addressed in -03).

-Dave

From: Dave Thaler
Sent: Friday, October 08, 2010 3:25 PM
To: [email-masked]'; [email-masked]'
Subject: Comments on draft-ietf-hybi-thewebsocketprotocol-02

I read through this document and have some comments, marked up in-place in

http://research.microsoft.com/~dthaler/draft-ietf-hybi-thewebsocketprotocol-02.pdf

Summary of comments:

1.      It needs to say how "match" is done on subprotocol values.  Is it exact match?  ASCII case-insensitive comparison?  Something else?   The recommendation is currently that it can contain domain names.   Do you recommend people use the U-label form or the A-label (Punycode-encoded) form?

2.      Should use uppercase MAY/SHOULD/MUST when it's intended (rather than lower-case may/should/must), and there's a bunch of cases where it uses "should" where I suspect MUST is more appropriate.  Similarly some places use "can" where I think it should be MAY.

3.      It says that servers can disconnect resource-hogging "users", but never says how it can identify a "user".  Certainly not by IPv4 address, as that could map to an entire city or larger, not to a "user".

4.      The use of the Origin field by the server is a bit vague when it says "the server could then decide how to respond (or indeed, _whether_ to respond) based on which site was requesting a connection".  Specifically, the server cannot tell whether the client is a browser or not.  I think it should say "... based on the Origin string sent by the client", since it has no trust in the correctness of the value, only the literal value itself.   It's sort of like a plaintext password here.

5.      The field "Sec-WebSocket-Draft" would seem an odd name once this becomes an RFC rather than a draft.  Why not something like "Sec-WebSocket-Version"?

6.      Section 10 says specifying the subprotocol is optional.  If it's not specified by a higher-layer protocol, what value is used?  Is the subprotocol field left an empty string?  Field omitted?  Some default value inserted?

7.      A bunch of typos

I'm not currently subscribed to the list, so please cc me on responses to this email.

Thanks,

-Dave Thaler