I'm sorry you were downvoted. However, at the end of the bug information there's a link to Mozilla's official documentation on WebSockets: https://developer.m

I'm sorry you were downvoted. However, at the end of the bug information there's a link to Mozilla's official documentation on WebSockets: https://developer.mozilla.org/en/WebSockets https://developer.mozilla.org/en/WebSockets There is a large, clear warning at the top: "Warning: Among other things, a key reason WebSockets is currently disabled by default is the discovery of a security issue in the protocol's design. Using WebSockets in a production environment is not recommended at this time." Mozilla's warning is based on the research report by Google into the WebSocket protocol. Here is the thread that started this off: http://www.ietf.org/mail-archive/web/hybi/current/msg04744.html http://www.ietf.org/mail-archive/web/hybi/current/msg04744.h... "The Upgrade-based handshake is vulnerable to attack in network configurations involving transparent (or intercepting) proxies. The core issue is that some number of transparent proxies do not understand the HTTP Upgrade mechanism and therefore don't understand that the remaining bytes sent by the attacker on the socket are not HTTP." Thank you for pointing this out!