9

Reading the Web Socket RFC, at 5.1 it says:

a client MUST mask all frames that it sends to the server (see Section 5.3 for further details). (Note that masking is done whether or not the WebSocket Protocol is running over TLS.) The server MUST close the connection upon receiving a frame that is not masked

but what's the purpose of such mask? If using Wireshark I'm reading the message the client sent without any problem?

3
  • If you're using Wireshark from the client or server end, I think you're reading them before they're sent/after they're received - so they're already unmasked at that point.
    – user81469
    Commented Feb 10, 2016 at 13:19
  • @SteffenUllrich that's a different thing. That's for setting the communication, basically a typical exchange of a hashed secret. However, the MASK is, in theory as I understand, for not showing the data in plain text, but it's there in the wire.
    – user15194
    Commented Feb 10, 2016 at 14:47
  • @yzT - you are right, the mask is per frame not per connection Commented Feb 10, 2016 at 15:09

1 Answer 1

11

The reason for the masking is to make websocket traffic look unlike normal HTTP traffic and become completely unpredictable. Otherwise any network infrastructure equipment which is not yet upgraded to understand the Websocket protocol can mistake it for normal http traffic causing various problems.

This is especially a problem for caching proxy servers and leads to possible attack scenarios. Specifically crafted websocket traffic can cause cache poisoning by tricking the proxy servers into mistaking a part of a websocket communication for a request and response for an unrelated URL, cache it like a legitimate response and send it to other users which request that URL.

1
  • just read all the caching proxy stuff (RFC 10.3), and seems you're right. The misunderstanding here I think is what Philip Rowlands said in the comment, because I noticed that in the data stream there is no message in plain text, but if I click on line-based text data (2.x) or unmask payload(1.x) section, the message is shown in an additional tab.
    – user15194
    Commented Feb 10, 2016 at 15:10

You must log in to answer this question.