javascript - Why do WebSockets use a hash in handshake? -


to open websocket, client connects tcp socket on server, , starts handshake.

the client's handshake contains base64 encoded key (sec-webscoket-key).

the server supposed respond sha-1(key + magic_constant), base64 encoded. magic_constant protocol-specific string (sec-websocket-accept).

what's purpose of this? i'm not seeing obvious security reasons doing so. doesn't authenticate either party. single sha-1 computation isn't proof of work.

the purpose of part of handshake make sure both sides of connection genuine websocket participants. designed easy implement real websocket clients , servers difficult attacker trick http client, server or proxy pretending websocket participant. in particular, bad if piece of malicious javascript running in browser open websocket connection normal http server because once connection established javascript have full control of sent on channel , try kinds of malformed on oversized data attempt breach or take down server.

update:

as @notallama points out, it's easy create malicious websocket client or use telnet send malicious data. difference websockets, attack comes trusted context (the user's browser , user's network). browsers load untrusted code internet used connect http server , intermediaries not exposed internet @ large. extreme example, imagine if instead of websockets, browsers open raw tcp connections (no enforced cors, hash check, etc). malicious piece of javascript can wants on users home network (or worse, work place intranet).

in particular, hybi working group spent inordinate amount of time addressing theoretical vulnerability in http intermediaries allow cache pollution using websocket connection fool intermediary think talking normal http client.


Comments

Post a Comment

Popular posts from this blog

jquery - How can I dynamically add a browser tab? -

since using iframes house external pages are, accounts "not preferred method" , disallowed sites (flickr, one), want dynamically generate browser tabs. e.g., when user submits form, want dynamically generate tab on browser in response submitted. e.g., might want add new tab url like: http://www.bigsurgarrapata.com/contact how in jquery? you want form target attribute action attribute. http://www.w3schools.com/tags/att_form_target.asp browsers have ultimate control on result of target attribute open new tab value of _blank. <form action="contact_submit.php" target="_blank" method="post">
Read more

node.js - Getting the socket id,user id pair of a logged in user(s) -

i have web application done using node js , in it,i have authentication system requires users log in before can access pages. have 2 pages,the homepage , updates page. from read docs,a new socket id issued when user opens tab in browser. me being admin,i know socket id of logged in user , more so,the socket id,logged in user id pair logged in users. what method can use socket id,logged in user id pair make sure broadcast realtime info users online?.
Read more

keyboard - C++ GetAsyncKeyState alternative -

i using windows.h library's getasynckeystate function define key pushed on keyboard . here program returns int value of pushed key example. #include <iostream> #include <windows.h> using namespace std; int main (){ char i; for(i=8;i<190;i++){ if(getasynckeystate(i)== -32767){ cout<<int (i)<<endl; } } return 0; } but trying make opengl simple game , function appeared slow . there function not need cycle 180 times , if statement . thanks you're trying make opengl game, you're going use glfw. if that's case can away using glfwgetkey() such: if (glfwgetkey(glfw_key_up) == glfw_press) {...} if (glfwgetkey(glfw_key_down) == glfw_press) {...} that method nicely explained in tutorial 6 opengl-tutorial.org . should start first tutorial of beginners tutorials , later intermediate tutorials . if you're going make win32 window can listen wm_keydown or wm_keyup messages , virtua
Read more