Skip to content

Commit fc25a90

Browse files
committed
ae.net.http.websocket: Make WebSocket accept() validation errors explicit
Split the WebSocket request validation enforce into multiple checks with specific error messages: - Method must be GET - HTTP version must be at least 1.1 - Upgrade header must be "websocket" - Connection header must contain "Upgrade" token - Sec-WebSocket-Key header must be present - Sec-WebSocket-Version header must be exactly "13"
1 parent f6524dd commit fc25a90

1 file changed

Lines changed: 6 additions & 9 deletions

File tree

net/http/websocket.d

Lines changed: 6 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -483,15 +483,12 @@ WebSocketAdapter accept(
483483
int compressionLevel = -1,
484484
)
485485
{
486-
enforce(
487-
request.method == "GET" &&
488-
request.protocolVersion >= "1.1" &&
489-
request.headers.get("Upgrade", null).icmp("websocket") == 0 &&
490-
request.headers.get("Connection", null).splitter(",").any!(t => t.strip.icmp("Upgrade") == 0) &&
491-
"Sec-WebSocket-Key" in request.headers &&
492-
request.headers.get("Sec-WebSocket-Version", null) == "13",
493-
"Invalid WebSockets request"
494-
);
486+
enforce(request.method == "GET", "WebSocket request method is not GET");
487+
enforce(request.protocolVersion >= "1.1", "WebSocket request HTTP version < 1.1");
488+
enforce(request.headers.get("Upgrade", null).icmp("websocket") == 0, "WebSocket request missing 'Upgrade: websocket' header");
489+
enforce(request.headers.get("Connection", null).splitter(",").any!(t => t.strip.icmp("Upgrade") == 0), "WebSocket request missing 'Connection: Upgrade' header");
490+
enforce("Sec-WebSocket-Key" in request.headers, "WebSocket request missing Sec-WebSocket-Key header");
491+
enforce(request.headers.get("Sec-WebSocket-Version", null) == "13", "WebSocket request Sec-WebSocket-Version is not 13");
495492

496493
auto response = new HttpResponse();
497494
response.status = HttpStatusCode.SwitchingProtocols;

0 commit comments

Comments
 (0)