Preserve client case for selected subprotocol

Egor Gorbunov · Egor Gorbunov · commit d3bc55c8cbfd · 2020-12-22T00:35:55.000+03:00
WebSocket implementation in chromium rejects
ws connections in case server side responses with
Sec-WebSocket-Protocol header which values does
not match values sent in the same header by client

In case you use protocols to send case-sensitive text
(for example, auth tokens) you end up with inability
to establish websocket connection from chromium.

So lets make selected protocol completely match one
send by the client. This patch does not break negotiation
rules and server protocols are still matched against client
protocols using EqualFold.
diff --git a/accept.go b/accept.go
@@ -219,7 +219,7 @@ func match(pattern, s string) (bool, error){
 }
 
 func selectSubprotocol(r *http.Request, subprotocols []string) string{
-	cps := headerTokens(r.Header, "Sec-WebSocket-Protocol")
+	cps := headerTokensExt(r.Header, "Sec-WebSocket-Protocol", false)
 	for _, sp := range subprotocols{
 		for _, cp := range cps{
 			if strings.EqualFold(sp, cp){
@@ -349,12 +349,18 @@ func websocketExtensions(h http.Header) []websocketExtension{
 }
 
 func headerTokens(h http.Header, key string) []string{
+	return headerTokensExt(h, key, true)
+}
+
+func headerTokensExt(h http.Header, key string, lower bool) []string{
 	key = textproto.CanonicalMIMEHeaderKey(key)
 	var tokens []string
 	for _, v := range h[key]{
 		v = strings.TrimSpace(v)
 		for _, t := range strings.Split(v, ","){
-			t = strings.ToLower(t)
+			if lower{
+				t = strings.ToLower(t)
+			}
 			t = strings.TrimSpace(t)
 			tokens = append(tokens, t)
 		}
diff --git a/accept_test.go b/accept_test.go
@@ -224,6 +224,12 @@ func Test_selectSubprotocol(t *testing.T){
 			serverProtocols: []string{"echo2", "echo3"},
 			negotiated: "echo3",
 		},
+		{
+			name: "clientCasePresered",
+			clientProtocols: []string{"Echo1"},
+			serverProtocols: []string{"echo1"},
+			negotiated: "Echo1",
+		},
 	}
 
 	for _, tc := range testCases{

-Original file line number
+Diff line change
+}
 funcselectSubprotocol(r*http.Request, subprotocols []string) string{
 -cps:=headerTokens(r.Header, "Sec-WebSocket-Protocol")
 +cps:=headerTokensExt(r.Header, "Sec-WebSocket-Protocol", false)
 for_, sp:=rangesubprotocols{
 for_, cp:=rangecps{
 ifstrings.EqualFold(sp, cp){
+}
 funcheaderTokens(h http.Header, keystring) []string{
 +returnheaderTokensExt(h, key, true)
 +}
++
 +funcheaderTokensExt(h http.Header, keystring, lowerbool) []string{
 key=textproto.CanonicalMIMEHeaderKey(key)
 vartokens []string
 for_, v:=rangeh[key]{
 v=strings.TrimSpace(v)
 for_, t:=rangestrings.Split(v, ","){
 -t=strings.ToLower(t)
 +iflower{
 +t=strings.ToLower(t)
 + }
 t=strings.TrimSpace(t)
 tokens=append(tokens, t)
+ }