Subject: [hybi] Clarification on the use of HTTP Authentication with WebSocket

From: "Bemmel, Jeroen Van (Jeroen Van)" <[email-masked]>
Date: Thu, 29 Sep 2011 12:14:50 +0200

All,

Section 10.5 of the latest draft states: http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-16#page-54<http://tools.ietf.org/html/draft-ietf-hybi-thewebsocketprotocol-16>

10.5.  WebSocket client authentication
   This protocol doesn't prescribe any particular way that servers can
   authenticate clients during the WebSocket handshake.  The WebSocket
   server can use any client authentication mechanism available to a
   generic HTTP server, such as Cookies, HTTP Authentication, or TLS
   authentication.

However, the WebSocket API being defined by W3C (currently) does not allow to set a username/password for HTTP Authentication for the WebSocket. Based on
http://lists.w3.org/Archives/Public/public-webapps/2011JulSep/1178.html this may be intentional: the idea would be that another resource from the same domain already triggered HTTP Authentication, and the browser would send the same credentials in the WebSocket handshake request.

Is this correct, and would it be worthwhile to add some clarification text? For example, a line after the above section:
"Note that HTTP Authentication would be used indirectly, i.e. the HTTP server already challenged a request for a resource in the same domain, and the web browser includes the same challenge response in an "Authorization" header during the WebSocket handshake"

Regards,
Jeroen

---

From: Bjoern Hoehrmann <[email-masked]>
Date: Thu, 29 Sep 2011 13:49:17 +0200

* Bemmel, Jeroen Van (Jeroen Van) wrote:
>However, the WebSocket API being defined by W3C (currently) does not
>allow to set a username/password for HTTP Authentication for the
>WebSocket.

>Is this correct, and would it be worthwhile to add some clarification
>text? For example, a line after the above section:
>"Note that HTTP Authentication would be used indirectly, i.e. the HTTP
>server already challenged a request for a resource in the same domain,
>and the web browser includes the same challenge response in an
>"Authorization" header during the WebSocket handshake"

Even if that was what a couple of web browser vendors intend to imple-
ment at the moment, it would not be a clarification for other users of
the protocol and phrased like that would require revision of the W3C
find they want to add features currently missing to their API.
-- 
Björn Höhrmann · mailto:[email-masked] · http://bjoern.hoehrmann.de
Am Badedeich 7 · Telefon: +49(0)160/4415681 · http://www.bjoernsworld.de
25899 Dagebüll · PGP Pub. KeyID: 0xA4357E78 · http://www.websitedev.de/