Subject: Re: [hybi] status of websockets drafts

From: Roderick Baier <[email-masked]>
Date: Wed, 05 May 2010 15:32:35 +0200

I'm sorry if this was already discussed, but I'm just trying to 
understand why the random bytes are in the body.
What's the idea behind placing them after the fields? Wouldn't it be 
easier to add an additional field "Sec-WebSocket-Key3" containing them?

Kind Regards, Roderick

---

From: Greg Wilkins <[email-masked]>
Date: Wed, 05 May 2010 16:12:01 +0200

> easier to add an additional field "Sec-WebSocket-Key3" containing them?

Roderick, they are not actually in the body of the request/response,
but just sent on the TCP/IP connection after the request/response -
so they don't represent either legal HTTP or framed websocket.

My understanding of the intent of putting them there is an attempt
to detect intermediaries that dumbly copy the upgrade header across,
but don't actually support upgrade and don't forward subsequent
packets.

As far as I can tell, there is no particular need for these
bytes to be the random bytes that are used as part of the
algorithm to confirm that the server is a websocket server.
The random bytes could all be in the header as you suggest
and some other bytes could be used to detect the failure
to forward packets.

My suggestion is that these random bytes be replaced by
a legal websocket frame with ping semantics sent from the
server to the client after the 101.   This way
clients,servers and intermediaries need not learn yet
another type of data to forward on the connection and
we can still detect if the connection is working prior
to notifying the client with an onOpen call.

cheers