[Webkit-unassigned] [Bug 82714] WebSockets: The handshake should check for US-ASCII data instead of UTF-8.

[bugzilla-daemon at webkit.org]

https://bugs.webkit.org/show_bug.cgi?id=82714





--- Comment #16 from Lamarque V. Souza <Lamarque.Souza at basyskom.com>  2013-03-21 19:43:02 PST ---
(In reply to comment #15)
> (From update of attachment 192240 [details])
> View in context: https://bugs.webkit.org/attachment.cgi?id=192240&action=review
> 
> > Source/WebCore/ChangeLog:10
> > +        The HTTP RFC specifies that HTTP headers should only contain US-ASCII
> > +        characters. Make sure handshake headers are conformant to this
> > +        constraint.
> 
> What does the WebSocket spec say about this?

I have found this:

Section 1.2 of WebSocket specification [1] says status line and header fields follow what is in HTTP specification [2]. Section 4.2 of [2] says header names are "token", which are US-ASCII strings according to section 2.2 of [2]. The values can be either UTF-8 or US-ASCII by what I understood from section 4.2. The only part of status line that would be non-US-ASCII is the URI, which section 2.1 of [3] says must be US-ASCII.

> Practically, clients do not enforce this for HTTP, so adding enforcement for WebSocket appears inconsistent.

Any reason why clients do not enforce this? When you say clients you mean other implementations other than WebKit, right?

[1] http://tools.ietf.org/html/rfc6455
[2] http://tools.ietf.org/html/rfc2616
[3] http://tools.ietf.org/html/rfc2396

-- 
Configure bugmail: https://bugs.webkit.org/userprefs.cgi?tab=email
------- You are receiving this mail because: -------
You are the assignee for the bug.