HTTP Redirect

Hi,

Are there any plans to support HTTP redirect on the WebSocket client side as defined in the RFC?

Thanks,

[sta]

Hello there,

Do you mean Proxy Usage defined in RFC 6455 Section 4.1?

Hi,

I mean this part:

1. If the status code received from the server is not 101, the
   client handles the response per HTTP [RFC2616] procedures. In
   particular, the client might perform authentication if it
   receives a 401 status code; the server might redirect the client
   using a 3xx status code (but clients are not required to follow
   them), etc. Otherwise, proceed as follows.

It seems only 101 and 401 responses are evaluated at the moment. I think it would be useful (at least for me) if either an automatic redirect is performed for 3xx responses or at least provide an event for unhandled response codes so that the client application can decide how to proceed.

[sta]

Thanks for reply, i know what you mean.

I had no plan to support that until now, but i think i want to support that though i can't yet promise when to do.

So plz stay open this issue.

[joelsand]

Hi sta, any more thoughts on this? It would be useful in my case as well. Thanks.

[joelsand]

On second thought, I think the security considerations need to be evaluated. According to this page (http://www.w3.org/TR/2011/WD-websockets-20110929/):

Warning! Following HTTP procedures here could introduce serious security problems in a Web browser context. For example, consider a host with a WebSocket server at one path and an open HTTP redirector at another. Suddenly, any script that can be given a particular WebSocket URL can be tricked into communicating to (and potentially sharing secrets with) any host on the Internet, even if the script checks that the URL has the right hostname.

Think about an HTTP POST. If the server responds to an HTTP POST with a redirect, the client does not re-post the data. Perhaps websockets should be treated the same way to prevent a client from sending sensitive information to the wrong server.

Anyway, this should be thought through before just adding the capability.

[sta]

Hello again,

Sorry, i have not yet considered more about this issue.

Btw, do you want it will be such as following?

ws.EnableRedirect = true; // If this property is true, connect to redirected host when receive a Redirect response.

Hi,

Yes, a property would be fine for enabling automatic redirect. Or you could extend the doHandshake() method to return the full HttpResponse to the client if it's not a valid handshake response (e.g. in the error event or in a new event). Then the client can decide how to handle this.