Subject: [hybi] Comments on draft-ietf-hybi-thewebsocketprotocol-02

From: Dave Thaler <[email-masked]>
Date: Fri, 8 Oct 2010 22:25:03 +0000

I read through this document and have some comments, marked up in-place in

http://research.microsoft.com/~dthaler/draft-ietf-hybi-thewebsocketprotocol-02.pdf

Summary of comments:

1.      It needs to say how "match" is done on subprotocol values.  Is it exact match?  ASCII case-insensitive comparison?  Something else?   The recommendation is currently that it can contain domain names.   Do you recommend people use the U-label form or the A-label (Punycode-encoded) form?

2.      Should use uppercase MAY/SHOULD/MUST when it's intended (rather than lower-case may/should/must), and there's a bunch of cases where it uses "should" where I suspect MUST is more appropriate.  Similarly some places use "can" where I think it should be MAY.

3.      It says that servers can disconnect resource-hogging "users", but never says how it can identify a "user".  Certainly not by IPv4 address, as that could map to an entire city or larger, not to a "user".

4.      The use of the Origin field by the server is a bit vague when it says "the server could then decide how to respond (or indeed, _whether_ to respond) based on which site was requesting a connection".  Specifically, the server cannot tell whether the client is a browser or not.  I think it should say "... based on the Origin string sent by the client", since it has no trust in the correctness of the value, only the literal value itself.   It's sort of like a plaintext password here.

5.      The field "Sec-WebSocket-Draft" would seem an odd name once this becomes an RFC rather than a draft.  Why not something like "Sec-WebSocket-Version"?

6.      Section 10 says specifying the subprotocol is optional.  If it's not specified by a higher-layer protocol, what value is used?  Is the subprotocol field left an empty string?  Field omitted?  Some default value inserted?

7.      A bunch of typos

I'm not currently subscribed to the list, so please cc me on responses to this email.

Thanks,

-Dave Thaler

---

From: John Tamplin <[email-masked]>
Date: Sun, 10 Oct 2010 11:56:39 -0400

On Fri, Oct 8, 2010 at 6:25 PM, Dave Thaler <[email-masked]> wrote:

>
> 5.      The field “Sec-WebSocket-Draft” would seem an odd name once this
> becomes an RFC rather than a draft.  Why not something like
> “Sec-WebSocket-Version”?
>
> The point was that it would not be present in the final version, only
during the draft stage while the spec is changing in incompatible ways.
 After the spec is finalized, there would be no versioning until and unless
we added a non-backwards-compatible change.  Ie, the absence of such
Sec-WebSocket-Version (or whatever) indicates 1.0, and we would try very
hard to avoid backwards incompatible changes.

-- 
John A. Tamplin
Software Engineer (GWT), Google