HTML5的WebSocket有點脫了褲子放那啥的趕腳

3P用戶

這貨在底層TCP握手連接以后，還要在應(yīng)用層HTTP握手，然后才能通信，握手還勉強可以忍受，讓人難以理解的是收發(fā)數(shù)據(jù)居然還要按照龜腚的格式，這不是窮折騰嗎？

前端用WebSocket，后臺就必須也要用WebSocket，就是說這貨不兼容常規(guī)的Socket通信，要獨辟蹊徑另立山頭。如果以前有其他技術(shù)做的應(yīng)用，現(xiàn)在要改成HTML5，后臺的服務(wù)器也要跟著改，有必要這么玩兒嗎？

我覺得其實只需要參考Flash的Socket，封裝為面向JS的事件驅(qū)動型就可以了，既簡單易用，又不失靈活性。

數(shù)據(jù)格式龜了腚了，現(xiàn)有的后臺服務(wù)器都不能跟WebSocket通信，真不明白這樣做到底有啥好處，我碼農(nóng)不懂大神的心。

daili0703

yjh777

http://stackoverflow.com/questio ... cp-sockets-in-flash

You can't do raw sockets from a web application in a browser. Even "raw" socket connections from Flash are not really raw because you have to answer a policy file request to get CORS security (part of the reason for the WebSockets handshake).

After the initial WebSocket handshake, WebSocket messages have two bytes of framing overhead per frame (Hixie-* has '\x00...\xff' and HyBi-07 has two byte header), so the overhead is pretty negligible compared to regular sockets.

The WebSocket handshake is an HTTP compatible Upgrade request so it is easy to integrate WebSockets support into existing web servers and to use existing Web ports (80/443) which means that WebSocket connection can also more easily integrate into existing firewall rules.

The HTTP compatible handshake also means that existing HTTP authentication mechanisms can work transparently with WebSockets. Also, WebSockets can be proxied by existing web proxies with little or no modification.

In the next revision of the WebSockets protocol rev (HyBi-07), their is protection against misbehaving web intermediaries using client to server XOR masking of the payload data.

Things like auto-reconnection, session ids, etc aren't defined in WebSockets although several Javascript frameworks built on WebSockets have this such as Socket.IO. If you are doing WebSockets from Flash applications then you would need to do your own session management or convert an existing session management library to use WebSockets rather than Flash sockets (such be pretty easy conversion).

evaspring

WebSocket 現(xiàn)在很多網(wǎng)絡(luò)庫都支持啊 但是確實有點惡心

folklore

W3C want WebSocket to be supported widely.

windoze

你不覺得讓一個webpage隨便開socket對你來說太不安全了嗎？
websocket本質(zhì)上就是加了一堆限制的socket，有了這些限制你才敢放心的讓它在你的瀏覽器上跑啊。

你問我為什么不用raw socket？你來說怎么在raw socket加一堆安全認(rèn)證之類的東西，然后讓它還能兼容原來的raw socket？

xinglp

windoze 發(fā)表于 2016-04-01 13:16
你不覺得讓一個webpage隨便開socket對你來說太不安全了嗎？
websocket本質(zhì)上就是加了一堆限制的socket，有 ...

這個安全性和普通socket的差別在哪里呢？ 加上一些包頭造成不能隨便建立socket連接任意協(xié)議的端口么？

windoze

回復(fù) 7# xinglp

安全性當(dāng)然是體現(xiàn)在瀏覽器里啊，你說兩個本地程序自建websocket通信……這是怎樣一種精神……病��？
瀏覽器必須要對網(wǎng)頁開連接做點限制，否則一個惡意網(wǎng)頁就可能把你的機器或者某個網(wǎng)站搞掛了。瀏覽器限制網(wǎng)頁開websocket的對端，限制連接數(shù)，甚至可以限制流量，而且瀏覽器知道網(wǎng)頁在websocket里傳輸?shù)臄?shù)據(jù)內(nèi)容，哪怕你用的是SSL websocket，因為SSL是瀏覽器代勞的。
要是用裸socket做這么多工作不得把瀏覽器累死，而且還會留下一堆漏洞。

3P用戶

我似乎有些理解大神們的想法了。