Websocket-Extension: NoXORMask IETF RFC Proposal Draft
Websocket is a robust, general, widely accepted and adopted communication protocol described in RFC 6455 (https://tools.ietf.org/html/rfc6455) The communication starts as a standard http or https request and then upgraded to persistent TCP connection of general use. In our experience and in comments on Internet, we detected one weakness and critics which restrict wider adoption of the protocol on Internal Networks: The mandatory masking of the frames sent from client to server, as explained in Section 5.3. of the RFC, titled Client-to-Server Masking. Every frame sent from client to server needs to carry additional 4 bytes on the header. Frame payload must be "XOR"ed with this 4 bytes prior being sent to server. And server must repeat this process as described in RFC Section 5.3. XOR Masking is developed for security reasons for communications on Internet over proxies. It may be acceptable on public Internet. But there is no logical reason to force XOR masking which ...