3 ms·
Exactly the other way around, some man in the middle attacks get confused in the presence of websockets: "The Upgrade-based handshake is vulnerable to attack in
by oofo 16y ago
Exactly the other way around, some man in the middle attacks get confused
in the presence of websockets: "The Upgrade-based handshake is vulnerable to attack in network
configurations involving transparent (or intercepting) proxies"
It's pretty weird that they consider this a problem with websockets.
- tptacek 16y agoIt's not an issue of "attributable fault". It's an issue of a reasonable protocol that doesn't work reliably on deployed infrastructure. Unlike, say, HTML5 Canvas, where failures still degrade somewhat gracefully, a failure that tickles a bug in a widely deployed proxy can be catastrophic. Let's all be clear that the "fault" lies in crappy HTTP code deployed in middleboxes (and that includes mine), but pragmatic in understanding that that doesn't matter; browsers can't become roving exploits for proxy bugs just because a standard says so.