Subject: [hybi] [Technical Errata Reported] RFC6455 (5453)

From: RFC Errata System <[email-masked]>
Date: Wed, 8 Aug 2018 06:41:10 -0700 (PDT)

The following errata report has been submitted for RFC6455,
"The WebSocket Protocol".

--------------------------------------
You may review the report below and at:
http://www.rfc-editor.org/errata/eid5453

--------------------------------------
Type: Technical
Reported by: Julian Reschke <[email-masked]>

Section: 4.1

Original Text
-------------
   2.  If the response lacks an |Upgrade| header field or the |Upgrade|
       header field contains a value that is not an ASCII case-
       insensitive match for the value "websocket", the client MUST
       _Fail the WebSocket Connection_.

Corrected Text
--------------
   2.  If the response lacks an |Upgrade| header field or the |Upgrade|
       header field contains a value that does not match "WebSocket",
       the client MUST _Fail the WebSocket Connection_.

Notes
-----
HTTP upgrade tokens are case-sensitive, and the token registered by RFC 6455 is "WebSocket" (see <https://www.iana.org/assignments/http-upgrade-tokens/http-upgrade-tokens.xhtml>). Examples should be adjusted accordingly.

If stricter checks actually break the protocol, an alternative would be to register more variants of the token, such as "websocket".

Instructions:
-------------
This erratum is currently posted as "Reported". If necessary, please
use "Reply All" to discuss whether it should be verified or
rejected. When a decision is reached, the verifying party  
can log in to change the status and edit the report, if necessary. 

--------------------------------------
RFC6455 (draft-ietf-hybi-thewebsocketprotocol-17)
--------------------------------------
Title               : The WebSocket Protocol
Publication Date    : December 2011
Author(s)           : I. Fette, A. Melnikov
Category            : PROPOSED STANDARD
Source              : BiDirectional or Server-Initiated HTTP APP
Area                : Applications
Stream              : IETF
Verifying Party     : IESG

---

From: Andy Green <[email-masked]>
Date: Thu, 09 Aug 2018 00:49:03 +0800

On August 8, 2018 9:41:10 PM GMT+08:00, RFC Errata System <[email-masked]> wrote:
>HTTP upgrade tokens are case-sensitive, and the token registered by RFC
>6455 is "WebSocket" (see
><https://www.iana.org/assignments/http-upgrade-tokens/http-upgrade-tokens.xhtml>).
>Examples should be adjusted accordingly.

I didn't see where registry entries are defined to be case sensitive.  RFC7230 8.6.1 doesn't seem to tell it either.

Assuming it's right, I think practically, this can't reasonably be 'fixed' in real-world RFC6455 implementations.

The receivers of the header (both clients and servers send and receive it) will mostly be okay, since they were warned to be on the lookout for case variations.

But I would guess 99% of senders of the upgrade header for RFC6455 responded to the existing text by issuing the specific string 'websockets' today.

With the first proposed change all those clients and servers (more or less all existing implementations) become noncompliant, which can't be the right way.

The second proposed way, with some case variations in the registry and some not, the conflict is not really solved.

Since this is a 'technical issue' in the sense the conflict is between RFC6455 text and the house rules of the registry, it can also be solved by the registry adding a note the "WebSockets" entry covers all case variations, can't it?  It's not like with the 5 or whatever entries in the registry to date, anyone was about to register 'weBsocKets'.  Or the registry can clearly state that all entries cover all case variations...

-Andy

>If stricter checks actually break the protocol, an alternative would be
>to register more variants of the token, such as "websocket".
>
>Instructions:
>-------------
>_______________________________________________
>hybi mailing list
>[email-masked]
>https://www.ietf.org/mailman/listinfo/hybi

---

From: Julian Reschke <[email-masked]>
Date: Wed, 8 Aug 2018 19:26:13 +0200

On 2018-08-08 18:49, Andy Green wrote:
> ...

It's defined to be a token, and that matches case-sensitively. See also 
<https://github.com/httpwg/http-core/issues/8>.

> ...

As this is "first come first serve", there really is no review process 
we can rely on...

In any case, it probably would be wise to register "websockets" as well, 
so that at least the examples become compliant.

Best regards, Julian