I’m testing on both and I’m using a server of my own making (using golang and gorilla websockets lib)
I get the same behaviour - and I do send the protocol back from the server, but now that protocol can be something other than binary.
I think ideally, if the protocol isn’t specified in params the build shouldn’t include the Sec-WebSocket-Protocol header at all, but I’m not sure how flexible emscripten is.
Ok, I understand. I would just return what the client sends, regardless of what it is. One less hardcoded value
I think ideally, if the protocol isn’t specified in params the build shouldn’t include the Sec-WebSocket-Protocol header at all, but I’m not sure how flexible emscripten is.
Yeah, I don’t think it’s very flexible in this regard. Also, “binary” is a perfectly acceptable default as it supports all data.
Not quite - I do need to set up the server to have the correct response header, it’s just that now it’s something reasonable (and something I can control). But that is the goal of this header anyway - to make sure that the client and server are communicating using the same schema, so hardcoded value here is not a bad thing.
The only issue with this is that the server does need to have this as a response - maybe some servers do have an option to just echo the protocol, but the tools I’m using means I do need to set up the server correctly.
For all other platforms, we use a C library called wslay, where we can control the websocket control frames (such as binary/text)
On HTML5, we use the builtin implementation of Emscripten.
I’m not entirely sure how to change that.
I’ll happily take suggestions.
Server receives the data and does nothing
As I’m new to the websocket server implementations, may I ask what benefit you get from working with “text”?
Personally, when I program, I always treat all data as binary, since I’ve had too many bugs where a system has tried to be “helpful” (e.g. converting whitespaces). I find it a lot easier to reason about if I know that I have the exact payload I stored/sent.
If yes then this makes sense, according to mixed content policies if a page was loaded over TLS then all other traffic from that page should be over TLS as well. (images, scripts, ws etc.)
If this wasn’t the case, then your HTTPS channel could potentially be pointless. As an attacker I would not be able to perform a man in the middle attack on the page itself, but if you load a resource on that page over insecure HTTP I would be able to inject things in those and compromise the entire page.
Not at all. We appreciate all the help we can get to test the extension. Could I please ask that you create a ticket here: GitHub · Where software is built
Please include as much detail as possible. The code you are using to test the extension, on which platform, against which server and so on.
Hi again.
Sorry, I’ve had to work on other issues during the week.
Will there be solution to this?
Not sure. I have an idea that might work, but would workaround the main functionality of Emscripten (which seems to always send that header).