charleslemaux/Mirror
1
0
Fork 0
mirror of https://github.com/MirrorNetworking/Mirror.git synced 2024-11-18 02:50:32 +00:00
Code Issues Actions Packages Projects Releases Wiki Activity

SimpleWebTransport: add SHA1 comments

Browse Source
This commit is contained in:
vis2k 2023-01-26 01:31:15 +09:00
parent 604503fa15
commit 01d0ae1a6b
2 changed files with 8 additions and 0 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

4
Assets/Mirror/Transports/SimpleWeb/Client/StandAlone/ClientHandshake.cs
View File

@ -28,6 +28,10 @@ public bool TryHandshake(Connection conn, Uri uri)
byte[] keySumBytes = Encoding.ASCII.GetBytes(keySum);
Log.Verbose($"[SimpleWebTransport] Handshake Hashing {Encoding.ASCII.GetString(keySumBytes)}");
// SHA1 is the websocket standard:
// https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_servers#server_handshake_response
// we should follow the standard, even though SHA1 is considered weak:
// https://stackoverflow.com/questions/38038841/why-is-sha-1-considered-insecure
byte[] keySumHash = SHA1.Create().ComputeHash(keySumBytes);
string expectedResponse = Convert.ToBase64String(keySumHash);

4
Assets/Mirror/Transports/SimpleWeb/Server/ServerHandshake.cs
View File

@ -19,6 +19,10 @@ internal class ServerHandshake
// this isn't an official max, just a reasonable size for a websocket handshake
readonly int maxHttpHeaderSize = 3000;
// SHA1 is the websocket standard:
// https://developer.mozilla.org/en-US/docs/Web/API/WebSockets_API/Writing_WebSocket_servers#server_handshake_response
// we should follow the standard, even though SHA1 is considered weak:
// https://stackoverflow.com/questions/38038841/why-is-sha-1-considered-insecure
readonly SHA1 sha1 = SHA1.Create();
readonly BufferPool bufferPool;