search

mtrudel / bandit

Bandit is a pure Elixir HTTP server for Plug & WebSock applications
MIT License
1.7k stars 85 forks source link

WSS broken by frame masking #422

Closed peaceful-james closed 6 days ago

peaceful-james commented 6 days ago

image

Maybe this is just happening for me. I am investigating.

peaceful-james commented 6 days ago

I confirm problem goes away when I run on commit cd855ec.

mtrudel commented 6 days ago

Thanks for the note. I'll back out that addition to give @alisinabh a chance to address it

peaceful-james commented 6 days ago

Thanks for the note. I'll back out that addition to give @alisinabh a chance to address it

Wait, I am blaming the wrong PR. It works fine on commit 898afdc.

peaceful-james commented 6 days ago

OK I confirm the problem is on commit f16b4c3 which is PR #421 which is yours @mtrudel

The call is coming from inside the house

mtrudel commented 6 days ago

Can you provide a repro?

alisinabh commented 6 days ago

I took a quick look and it seems like we responding with compression enabled (content-encoding: gzip) on websocket which is not supported for websocket (it is but permessage-deflate must be used).

Working version

Screenshot 2024-11-18 at 11 32 07 AM

Not working version

Screenshot 2024-11-18 at 11 32 26 AM
mtrudel commented 6 days ago

Got it! I backed that PR out of main/1.6.0 and re-released. I'll get this fixed directly.

Since this is no longer an issue on main I'll copy the relevant details from here over to #421 (which I'll also reopen).

Thanks for the quick bug @peaceful-james !

peaceful-james commented 6 days ago

OK that explains why my repro was not working. 😆 Thanks for the swift response!