Add check for Sec-WebSocket-Key header

[hirasawayuki]

Fixes issue: #617

Added the following two fixes

• Check that Sec-websocket-key is encoded as base64
• Check that Sec-Websocket-Key is encoded from 16 bytes long

RFC6455 states the following:

A |Sec-WebSocket-Key| header field with a base64-encoded value that, when decoded, is 16 bytes in length.

[garyburd]

Do popular libraries for other programming languages reject invalid keys? I don't want this package to the only library that rejects invalid keys.

Assuming that it's common practice to reject invalid keys, please move the logic to new function isValidChallengeKey(s string) bool { } in util.go. I want to keep the functionality related to keys in one file.

It's OK to return a single error message for invalid keys.

[hirasawayuki]

@garyburd
Thanks for the review! I checked the ws(nodejs library), and it seems to return HTTP Status 400 if it doesn't match regular expression of encoded 16-byte string. (/^[+/0-9A-Za-z]{22}==$/)
So I saw no problem in rejecting an invalid key.

https://github.com/websockets/ws/blob/5edf1f4a1b1750109c1bb56eff7ad78902eee7dc/lib/websocket-server.js#L18
https://github.com/websockets/ws/blob/5edf1f4a1b1750109c1bb56eff7ad78902eee7dc/lib/websocket-server.js#L236-L245

[garyburd]

LGTM.

The nodejs library provides strong evidence that the check is OK, but I want check more libraries before accepting the PR. One cause for concern is that the Autobahn|Testsuite does not test invalid keys.

[hirasawayuki]

@garyburd
I'll let you be the judge! 😃

[andrewhodel]

There is a maximum limit of the incoming data per the base64 limit.

You should add an error from the upgrader if the size is exceeded for two reasons:

1. The response isn't unknowingly handled in the module code like go's http 301 when there is a .. in the url path.

2. The developer gets to decide how strict to be instead of a lower level structure that doesn't participate in these cost decisions.

[andrewhodel]

The base64 alphabet has a limit per byte with regards to representation size.