Re: [whatwg/fetch] Stop saying WebSocket auth is disallowed (#761)

ricea commented on this pull request.



> @@ -6301,12 +6301,11 @@ therefore not shareable, a WebSocket connection is very close to identical to an
 <p><dfn>Fail the WebSocket connection</dfn> and <dfn>the WebSocket connection is established</dfn>
 are defined by The WebSocket Protocol. [[!WSP]]
 
-<p class=warning>The reason redirects are not followed, HTTP authentication will not function, and
-this handshake is generally restricted is because that could introduce serious security problems in

I took out the "generally restricted" part because I couldn't describe the nature of the restriction.

In Chrome's implementation we're pretty restrictive: we error on anything other than 101, 401 or 407 response, and UI is not shown for authentication or TLS failures. Do you think there's a way we could codify some or all of these restrictions in the standard?

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/whatwg/fetch/pull/761#discussion_r194283939