HTML5的WebSocket有点脱了裤子放那啥的赶脚

3P用户

这货在底层TCP握手连接以后，还要在应用层HTTP握手，然后才能通信，握手还勉强可以忍受，让人难以理解的是收发数据居然还要按照龟腚的格式，这不是穷折腾吗？

前端用WebSocket，后台就必须也要用WebSocket，就是说这货不兼容常规的Socket通信，要独辟蹊径另立山头。如果以前有其他技术做的应用，现在要改成HTML5，后台的服务器也要跟着改，有必要这么玩儿吗？

我觉得其实只需要参考Flash的Socket，封装为面向JS的事件驱动型就可以了，既简单易用，又不失灵活性。

数据格式龟了腚了，现有的后台服务器都不能跟WebSocket通信，真不明白这样做到底有啥好处，我码农不懂大神的心。

daili0703

yjh777

http://stackoverflow.com/questio ... cp-sockets-in-flash

You can't do raw sockets from a web application in a browser. Even "raw" socket connections from Flash are not really raw because you have to answer a policy file request to get CORS security (part of the reason for the WebSockets handshake).

After the initial WebSocket handshake, WebSocket messages have two bytes of framing overhead per frame (Hixie-* has '\x00...\xff' and HyBi-07 has two byte header), so the overhead is pretty negligible compared to regular sockets.

The WebSocket handshake is an HTTP compatible Upgrade request so it is easy to integrate WebSockets support into existing web servers and to use existing Web ports (80/443) which means that WebSocket connection can also more easily integrate into existing firewall rules.

The HTTP compatible handshake also means that existing HTTP authentication mechanisms can work transparently with WebSockets. Also, WebSockets can be proxied by existing web proxies with little or no modification.

In the next revision of the WebSockets protocol rev (HyBi-07), their is protection against misbehaving web intermediaries using client to server XOR masking of the payload data.

Things like auto-reconnection, session ids, etc aren't defined in WebSockets although several Javascript frameworks built on WebSockets have this such as Socket.IO. If you are doing WebSockets from Flash applications then you would need to do your own session management or convert an existing session management library to use WebSockets rather than Flash sockets (such be pretty easy conversion).

evaspring

WebSocket 现在很多网络库都支持啊 但是确实有点恶心

folklore

W3C want WebSocket to be supported widely.

windoze

你不觉得让一个webpage随便开socket对你来说太不安全了吗？
websocket本质上就是加了一堆限制的socket，有了这些限制你才敢放心的让它在你的浏览器上跑啊。

你问我为什么不用raw socket？你来说怎么在raw socket加一堆安全认证之类的东西，然后让它还能兼容原来的raw socket？

xinglp

windoze 发表于 2016-04-01 13:16
你不觉得让一个webpage随便开socket对你来说太不安全了吗？
websocket本质上就是加了一堆限制的socket，有 ...

这个安全性和普通socket的差别在哪里呢？ 加上一些包头造成不能随便建立socket连接任意协议的端口么？

windoze

回复 7# xinglp

安全性当然是体现在浏览器里啊，你说两个本地程序自建websocket通信……这是怎样一种精神……病啊？
浏览器必须要对网页开连接做点限制，否则一个恶意网页就可能把你的机器或者某个网站搞挂了。浏览器限制网页开websocket的对端，限制连接数，甚至可以限制流量，而且浏览器知道网页在websocket里传输的数据内容，哪怕你用的是SSL websocket，因为SSL是浏览器代劳的。
要是用裸socket做这么多工作不得把浏览器累死，而且还会留下一堆漏洞。

3P用户

我似乎有些理解大神们的想法了。