Subject: [hybi] -05: sec-websocket-nonce http response header

From: "Pat McManus @Mozilla" <[email-masked]>
Date: Fri, 11 Feb 2011 12:12:35 -0500

I feel kinda dumb asking this, but is the sec-websocket-nonce response
header used for anything in -05? It is required to be included in the
response, but I do not see where it is used. It is not used to verify
sec-websocket-accept.

Relatedly an editorial nit, Section 10.4 says:

"The |Sec-WebSocket-Key| and |Sec-WebSocket-Nonce| headers are used in
   the WebSocket handshake.  They are sent from the client to the server [..]"

Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..

-- 
http://www.getfirefox.com/

---

From: Andy Green <[email-masked]>
Date: Fri, 11 Feb 2011 17:16:55 +0000

> Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..

Yeah in 04 it was the server's ingredient in the shared connection key. 
  But in 05, they don't keep a 20-byte connection key any more and just 
use the per-frame key raw without referring to anything else.

So this is a (mistaken) holdover from 04 you spotted I think that can be 
deleted.

-Andy

---

From: Takeshi Yoshino <[email-masked]>
Date: Fri, 11 Feb 2011 09:46:31 -0800

Yes, and it's already addressed on the ToT.
http://trac.tools.ietf.org/wg/hybi/trac/changeset/64/websocket/draft-ietf-hybi-thewebsocketprotocol.xml

On Fri, Feb 11, 2011 at 09:16, Andy Green <[email-masked]> wrote:

>  But in 05, they don't keep a 20-byte connection key any more and just use
> the per-frame key raw without referring to anything else.
>

---

From: Greg Wilkins <[email-masked]>
Date: Mon, 14 Feb 2011 11:24:27 +1100

> Sec-Websocket-Nonce is not sent from the client to the server, so that should be fixed up..

Also is there any benefit in having Sec- on any of the headers sent
from the server?
My understanding is that Sec- is a browser mechanism to restrict what
can be sent from XHR and thus is not applicable to server headers.

cheers

---

From: Iñaki Baz Castillo <[email-masked]>
Date: Mon, 14 Feb 2011 17:53:22 +0100

> Also is there any benefit in having Sec- on any of the headers sent

Perhaps the draft has changed too much in last version, but AFAIK
Sec-Websocket-Nonce (sent by the server) is required for the client in
order to mask data.

-- 
Iñaki Baz Castillo
<[email-masked]>