68

In section 1.3 "Opening Handshake" of draft-ietf-hybi-thewebsocketprotocol-17, it describes Sec-WebSocket-Key as follows:

To prove that the handshake was received, the server has to take two pieces of information and combine them to form a response. The first piece of information comes from the |Sec-WebSocket-Key| header field in the client handshake:

Sec-WebSocket-Key: dGhlIHNhbXBsZSBub25jZQ==

For this header field, the server has to take the value (as present in the header field, e.g. the base64-encoded [RFC4648] version minus any leading and trailing whitespace), and concatenate this with the Globally Unique Identifier (GUID, [RFC4122]) "258EAFA5-E914-47DA-95CA-C5AB0DC85B11" in string form, which is unlikely to be used by network endpoints that do not understand the WebSocket protocol. A SHA-1 hash (160 bits), base64-encoded (see Section 4 of [RFC4648]), of this concatenation is then returned in the server's handshake [FIPS.180-2.2002].

Here's the thing I can't understand: why not simply return code 101? If the proper use of Sec-WebSocket-Key is for security, or to prove they can handle websocket requests, then any server could return the expected key if they wanted to, and pretend they are a WebSocket server.

2
  • Has it occurred to anyone that the Sec-WebSocket-Key HTTP Header can be a Public RSA Key? And obviously vice versa if you understand OpenSSL? That this technology is so powerful that just thinking of its potential within a browser context is literally limiting its potential within the grand scheme of things?
    – suchislife
    Feb 5, 2021 at 3:31
  • @suchislife Nope, the spec says that is a 16 byte b64 coded nonce chosen randomly for each handshake.
    – kazza
    May 14, 2021 at 7:44

5 Answers 5

47

According to RFC 6455 Websocket standard

first part:

.. the server has to prove to the client that it received the
client's WebSocket handshake, so that the server doesn't accept
connections that are not WebSocket connections.  This prevents an
attacker from tricking a WebSocket server by sending it carefully
crafted packets using XMLHttpRequest [XMLHttpRequest] or a form
submission.

...
For this header field, the server has to take the value (as present
in the header field, e.g., the base64-encoded [RFC4648] version minus
any leading and trailing whitespace) and concatenate this with the
Globally Unique Identifier (GUID, [RFC4122]) "258EAFA5-E914-47DA-
95CA-C5AB0DC85B11" in string form, which is unlikely to be used by
network endpoints that do not understand the WebSocket Protocol.

second part:

The |Sec-WebSocket-Key| header field is used in the WebSocket opening
handshake.  It is sent from the client to the server to provide part
of the information used by the server to prove that it received a
valid WebSocket opening handshake.  This helps ensure that the server
does not accept connections from non-WebSocket clients (e.g., HTTP
clients) that are being abused to send data to unsuspecting WebSocket
servers.

So, as the value of the GUID is specified in the standard, it is unlikely (possible, put with very small probability) that the server which is not aware of Websockets will use it. It does not provide any security (secure websockets - wss:// - does), it just ensures that server understands websockets protocol.

Really, as you've mentioned, if you are aware of websockets (that's what to be checked), you could pretend to be a websocket server by sending correct response. But then, if you will not act correctly (e.g. form frames correctly), it will be considered as a protocol violation. Actually, you can write a websocket server that is incorrect, but there will be not much use in it.

And another purpose is to prevent clients accidentally requesting websockets upgrade not expecting it (say, by adding corresponding headers manually and then expecting smth else). Sec-WebSocket-Key and other related headers are prohibited to be set using setRequestHeader method in browsers.

6
  • it's true some request header fields can't be modified from javascript in XMLHttpRequest,so the way from browser is blocked? but what if there is a browser(maybe an early version) that can allow modify the Sec-websocket-key field?or if the request are send by a program to simulate a browser, you can totally build the request header by yourself,thus made Sec-WebSocket-Key non-sense? Aug 16, 2013 at 12:03
  • 5
    Please, re-read my answer. Even if you write your server or client that will emulate the correct upgrade request, you would do it intentionally with the knowledge that Websockest protocol exists. The Sec-WebSocket-Key is used to filter unintended requests. If you bother about security - use secure websockets.
    – Pavel K
    Aug 16, 2013 at 12:37
  • so the protocol is designed based on ppl would use it normally,if face a malicious software writer it would be screw up like normal http, do i get it right? Aug 17, 2013 at 7:44
  • 1
    Definitely, you can break normal flow of the protocol if you know how it work. And exactly for that purpose (if you like to be sure everything is under your control) cryptography and secure protocols were proposed. The idea is to separate data transfer in certain format (for that HTTP and Websocket protocols are responsible) and security (SSL/TLS in role here), because latest adds some performance overhead that might be unnecessary. And secure data transfer is provided combining those - and named HTTPS/WSS.
    – Pavel K
    Aug 17, 2013 at 9:43
  • @PavelK I am developing a client for Windows and will spread it through different machines. For a client point of view, is it a good practice to stick with a fixed encoded key ? I mean, if this field in base64encoded.... what is the decoded origin string then ? a random value ?
    – Jack M.
    Jul 19, 2014 at 9:05
29

Mostly for cache busting.

Imagine a transparent reverse-proxy server watching HTTP traffic go by. If it doesn't understand WS, it could mistakenly cache a WS handshake and reply with a useless 101 to the next client.

Using a high-entropy key and requiring a basic challenge-response rather specific to WS ensures the server actually understood this was a WS handshake and in turn tells the client that the server will indeed be listening on the port. A caching reverse-proxy would never implement that hashing logic "by mistake".

4
  • A reverse proxy server shouldn't consider 101 responses to be catchable so imo this isn't a strong reason.
    – nhooyr
    Sep 8, 2018 at 1:47
  • 1
    @nhooyr You're right. If my (definitively speculative) answer is correct about the rationale, it'd clearly be a very defensive measure against badly programmed software. Given these can be on a path outside of the control of either the client and the server, it seemed to me like a reasonable thing to defend against.
    – tne
    Sep 8, 2018 at 17:06
  • @nhooyr No. By the earlier HTTP standard, a proxy MAY cache HTTP 101 (and all other results). This answer seems correct.
    – kubanczyk
    May 12, 2019 at 9:09
  • Moreover, reading the first WebSocket RFC, it looks like the designers left the door open for (intelligently) caching WebSocket traffic, however strange it may seem.
    – kubanczyk
    May 12, 2019 at 9:15
11

I'm inclined to agree.

Nothing of importance would change if the client ignored the value of the Sec-WebSocket-Accept header.

Why? Because the server is not proving anything by doing this calculation (other than that it has the code to do the calculation). Just about the only thing it rules out is a server that simply replies with a canned response.

The exchange of headers (e.g. with fixed 'key' and 'accept' values) is already sufficient to rule out any accidental connection with something that is not at least trying to be a WebSocket server; and if it's trying, the requirement that it do this calculation is hardly an impediment to its succeeding.

The RFC claims:

".. the server has to prove to the client that it received the client's WebSocket handshake, so that the server doesn't accept connections that are not WebSocket connections."

and:

"This helps ensure that the server does not accept connections from non-WebSocket clients .."

Neither of these claims make any sense. The server is never the one rejecting the connection because it is the one computing the hash, not the one checking it.

This sort of exchange would make some sense if the magic GUID were not fixed, but were instead a shared secret between client and server. In that case the exchange would allow the server to prove to the client that it had the shared secret without revealing it.

2

The RFC 6455 spec shows the (minimum) 4 lines that the server needs to respond to the client (browser) with. The hardest part is confirming your Websocket server C code is doing the right calculations. Here's a short PHP script (PHP is easy to install on all OS's) that will properly calculate the key to reply with. Hard-code the key you get from the client (browser) into the 2nd line below:

<?php
    $client_websocket_key = "IRhw449z7G0Mov9CahJ+Ow==";
    $concat = $client_websocket_key . "258EAFA5-E914-47DA-95CA-C5AB0DC85B11";
    $ascii_sha1 = sha1( $concat );  // print this one for debugging, not used for real value.
    $sha1 = sha1( $concat, true );
    echo base64_encode( $sha1 );
?>
1

What the RFC is unclear about is that the "Sec-WebSocket-Key" header from the client should be random on each request. Which means any cached result from a proxy will contain an invalid "Sec-WebSocket-Accept" reply header and thus the websocket connection will fail instead of reading cached data unintentionally.

1
  • 1
    The RFC says: The value of this header field MUST be a nonce consisting of a randomly selected 16-byte value that has been base64-encoded - it is the definition of a nonce.
    – Viktor
    Oct 10, 2022 at 9:53

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.