search

linagora / james-project

Mirror of Apache James Project
Apache License 2.0
72 stars 62 forks source link

JMAP Websocket: server should return `Sec-WebSocket-Protocol: jmap` header? #5269

Closed quantranhong1999 closed 1 month ago

quantranhong1999 commented 2 months ago

Why

@tddang-linagora tried to follow JMAP websocket specs cf https://www.rfc-editor.org/rfc/rfc8887.html#name-handshake.

He want to initiate the websocket connection and put in the first HTTP request the Sec-WebSocket-Protocol: jmap header and Postman return Error: Server sent no subprotocol.

Likely Postman validated that there was no Sec-WebSocket-Protocol: jmap header in the response.

Image

From the specs: Otherwise, the client MUST make an [authenticated HTTP request](https://www.rfc-editor.org/rfc/rfc8887.html#RFC7235) [[RFC7235](https://www.rfc-editor.org/rfc/rfc8887.html#RFC7235)] on the encrypted connection and MUST include the value "jmap" in the list of protocols for the "Sec-WebSocket-Protocol" header field. The reply from the server MUST also contain a corresponding "Sec-WebSocket-Protocol" header field with a value of "jmap" in order for a JMAP subprotocol connection to be established.

The word Otherwise seems vague to me as it makes me have the impression that the Sec-WebSocket-Protocol header usage is just optional/fallback. However, it seems that the header is common and our server should support that header.

How

James JMAP Websocket server should return the Sec-WebSocket-Protocol response header upon HTTP authenticated request.

And likely we should reject the request without the the Sec-WebSocket-Protocol header too.

DoD

Tests.

chibenwa commented 1 month ago

Can we just open a small PR prior the sprint starts so that it don't remain unadressed too long?

quantranhong1999 commented 1 month ago

https://github.com/apache/james-project/pull/2426