Skip to content

Conversation

@leibnitz27
Copy link

Chrome, since 44.0.2403.130, adds Upgrade-Insecure-Headers to basic http (NOT websocket) requests.

Previously, checks that a request was NOT a websocket upgrade were performed with

  # Web request
  if (is.null(J$wsinfo$Upgrade)) {
    # Not a handshake request, serve a static web page

Because R allows for prefix matching when performing $ lookups, this means the presence of Upgrade-Insecure-Headers fools R-Websockets into considering ALL requests to be websocket upgrades.

Use an exact match, via [["Upgrade"]] instead.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant