ra23.net Just another WordPress weblog


Websocket protocol changes

On early December 2010 Christopher Blizzard announced the removement of the websocket implementation in FF 4.0
(Opera also removed it.)

There was an attack scenario which poisons a proxy server such that the upgrade handshake of the websockets can be attacked.
Look here if you are interested in the details.

This means for my implementation it has to wait until the actual draft gets updated/modified.
It makes no sense for further developing without knowing what actually will change in the specification.

I will continue coding on my implementation as soon as the draft is updated and browsers who removed it re-enable websockets again.

Filed under: html5, php, websockets No Comments

Websocket implementation in php


yesterday I wanted to do some tests with Websockets which will be available when HTML5 is coming to the real world.

I downloaded a phpwebsocket implementation, done early this year and tried to get it running with the examples.

Soon I noticed, it cannot work, cause the browsers (I tested with Chrome and Firefox), modified the way they handle the handshakes.
Earlier this year, it was possible to just send a standard reply to the browser and the connection gets initiated.

Now you have to do some calculations from given keys from the browser at server side.
So the browser initiates the connection to a socket and sends some data.


GET / HTTP/1.1
Connection: Upgrade
Host: example.com
Upgrade: WebSocket
Sec-WebSocket-Key1: 3e6b263  4 17 80
Origin: http://example.com
Sec-WebSocket-Key2: 17  9 G`ZD9   2 2b 7X 3 /r90


At server side, you have to do the following now:

Extract the keys
Count Spaces
get random challenge
concatenate calculated keys+random challenge
build md5 hash of concatenation 
and sent it back to the client.

If the generated hash value is the one the client expects, you get a connection, else this fails.

It took quite some time to get this running, maybe I will explain the implementation later.

I've uploaded my code to sourceforge, you can download it from there if you want to test it.

svn co https://phpwebsocket.svn.sourceforge.net/svnroot/phpwebsocket phpwebsocket 

It is not working for multiple clients from the same machine, but for a first test or impression its usable.
I will do some work on the code to fix this, but for know you have to live with that :)

If you downloaded the code, just start the server with:

php TestServer.php

Open your browser and point it to the client html file called test.html in the client directory.

If you have any question or problem, just let me know.

Filed under: html5, php, websockets No Comments