Subject: Re: [hybi] "Establish a WebSocket Connection" does not allow for cookies

From: Anne van Kesteren <[email-masked]>
Date: Mon, 14 Mar 2016 09:29:02 +0100

On Thu, Sep 17, 2015 at 2:54 PM, Salvatore Loreto
<[email-masked]> wrote:
> Not completely sure, but maybe we can worn on an Errata to clarify this

FWIW, since the group was closed, and this didn't get addressed, I
didn't really anticipate similar issues to get addressed either. So
for now we have this patch of the WebSocket protocol in Fetch that
ensures any security features that the browser gets for fetching
resources, also get applied to the WebSocket client handshake (e.g.,
the upgrade insecure requests feature and port blocking).

And the WebSocket API simply references that algorithm:

https://fetch.spec.whatwg.org/#websocket-protocol
https://html.spec.whatwg.org/multipage/comms.html#dom-websocket

In the course of doing this we also found that the WebSocket API
didn't allow for extensions, while all browsers implement one, so we
have opened

https://github.com/whatwg/html/issues/852

to address that and I hope to get to it soonish. Likely today.

-- 
https://annevankesteren.nl/