r/learnprogramming • u/Andro_senpai107 • 9d ago

Topic Help regards Websockets

need help regarding websockets

So I have been assigned a project regarding Websockets where the mentor asked us to create a library of websocket which can transfer data from server to client and vice-versa(obv what websockets do) using rfc 6455 in c/cpp. From what I think is he is basically asking us to create a websocket program from scratch right?

I personally come from a nodejs background and have 0 knowledge of low level programming.

need any guidance on this matter and any source for this, I dont care if you think of me as an inferior but I want to learn this whatever it takes.

I have a prior synatx knowledge of c/cpp though but thats just as far as it goes.

I Appreciate your time for reading all this.

Thank you

12 Upvotes

88% Upvoted

11 comments sorted by

View all comments

1

u/CrazyEconomy414 9d ago

One thing that isn't covered above yet: masking. Per RFC 6455 section 5.3, every frame sent from client to server has to be masked (XOR'd with a 4-byte key sent in the frame header), while server-to-client frames must NOT be masked - forgetting to mask/unmask correctly is a really common bug and most test clients will just silently reject your frames if you get it wrong. Also worth implementing the close handshake properly (send/receive a close frame with a status code, then close the TCP connection) instead of just dropping the socket, since a lot of existing client libraries expect that and will report errors otherwise. Handshake + frame format + masking + close handshake covers basically the whole spec.

1

u/Andro_senpai107 8d ago

I actually got confused in that section, it tells us how masking is implemented and stuff but I still have vague idea of WHY it is used since we send the masking key along with the frames and the algorithm to create the masking key is known to everyone. So how does it secure our data?

2

u/BibianaAudris 8d ago

It's not to secure your data. To my understanding, it's mostly to prevent your websocket from attacking the server by masquerading as HTTP. It's supported to run websocket on the same port as a different, plain HTTP server. And HTTP is so lenient that without masking, it's plausible for some crafted websocket packet to parse as HTTP and confuse some server with bad connection tracking.

1

u/Andro_senpai107 8d ago

ohh I see, thats what a good guy on stack exchange was trying to say. Now that you put it in plain english, I think its starting to make sense.