Real Time Updates hard
According to RFC 6455, why must clients Mask (XOR) the payload of frames sent to the server?
- A To compress the data.
- B To encrypt the data against hackers.
- C To prevent 'Cache Poisoning' attacks on intermediate proxies. If a proxy sees cleartext looks like an HTTP response inside a WS frame, it might cache it incorrectly.
- D To increase transmission speed.
Answer: C. To prevent 'Cache Poisoning' attacks on intermediate proxies. If a proxy sees cleartext looks like an HTTP response inside a WS frame, it might cache it incorrectly.
This is a specific defense against 'Infrastructure confusion'. By XORing the payload with a random key, the data on the wire looks like random garbage to outdated proxies, preventing them from misinterpreting bytes as HTTP commands.
One system design question a day, with spaced repetition so the ones you miss come back.
Get the appRelated questions
- When a mobile app is closed/backgrounded, it cannot keep a WebSocket open. How does it receive real-time alerts (like 'New Message')?
- For a human user, what is generally considered the maximum acceptable latency for an interaction to feel 'Real-Time' (e.g., typing in a Google Doc)?
- If you want to update a news feed on a website every time a new article is published, what is the simplest (but least efficient) 'Real-Time' technique?
- In a persistent real-time connection, what is the purpose of a 'Heartbeat' or 'Ping/Pong' message?
- Why is Short Polling considered 'Chatty'?
- Server-Sent Events (SSE) are ideal for which type of real-time application?