WebSocket draft-hixie-76

~ the goodbye ~

WebSocket was the answer to a decade of pretending. Browsers had been faking a live connection with long-polling and hidden iframes, and the proposal was to do the honest thing instead. You opened a socket over port 80 with an HTTP request asking to be upgraded, and once the server agreed, neither end spoke HTTP again. Ian Hickson wrote the wire protocol, and the revision that browsers actually shipped was draft-hixie-thewebsocketprotocol-76, published on 6 May 2010.

Its handshake was strange in a way that mattered later. The client sent two headers, Sec-WebSocket-Key1 and Key2, each carrying a number with random characters and spaces sprinkled through it. The server had to pull the digits out and divide each number by how many spaces it had found beside them. It then MD5'd the two results together with eight more bytes that the client had sent after the headers, with no Content-Length to announce them. All of that was there to prove the other end was a real WebSocket implementation rather than something being tricked into sending bytes.

It proved the opposite. Adam Barth demonstrated that a transparent proxy sitting between the browser and the server could read the handshake as an ordinary HTTP request and treat whatever followed as authentic. The result was an attacker's content in a shared cache under somebody else's URL. Mozilla's write-up puts the stakes plainly: a widely used JavaScript file could be replaced in a shared cache with a malware file, with nothing traceable back to the real server. The Flash and Java fallbacks everyone used for older browsers had the same hole.

~ the chronicle ~

~ the week it was turned off ~

On 8 December 2010 Chris Heilmann posted "WebSocket disabled in Firefox 4" on Mozilla's developer blog. Beta 7 had shipped the -76 protocol, the same version Chrome and Safari were running. Beta 8 took it out: "That's why we've decided to disable support for WebSocket in Firefox 4, starting with beta 8 due to a protocol-level security issue." Anne van Kesteren announced that Opera was dropping it too. Both left the code in, reachable only through a hidden preference, and both said they would turn it back on once there was a protocol worth turning on.

The replacement went to an IETF working group called HyBi. Firefox came back on 16 August 2011 in version 6, speaking draft 07 and with the global object renamed MozWebSocket so that nobody could use its presence to detect the real thing, a prefix it kept through version 10. Chrome 14 moved that September and RFC 6455 was published in December 2011. Firefox 11 dropped the prefix in March 2012, and Safari 6 arrived on 25 July 2012 as the last of the four to leave -76 behind. The datatracker page for the old draft now reads "Expired & archived".

Nothing I was building in 2010 held a live socket open, so this cost me nothing at the time and I read about it later. What makes it stick is how strange the argument was for a browser bug. No single vendor could fix this one, because the faulty part was sitting in somebody else's network equipment, reading a handshake it had every right to misunderstand.

~ dating this one ~

The grave is filed on 8 December 2010, and that needs saying out loud, because -76 was still being spoken by two shipping browsers for another eighteen months after it. The argument is that the version stopped being a protocol on the day two of its implementers withdrew it in public for a reason nobody disputed. No browser adopted it after that week, and the specification work moved to a different document with a different owner. The Safari 6 date is in the file as well, for anybody who prefers to date a protocol by its last renderer, which is how this corpus dated Embedded OpenType.

@}-->--

              )
             (_)
            .-'-.
            |   |
            |   |
            |   |
            |   |
          __|   |__   .-.
       .-'  |   |  `-:   :
      :     `---'     :-'
       `-._       _.-'
           '""""""

« previous  ·  random  ·  next »