WebSockets disabled in Firefox 4
Due to a vulnerability in the design of the WebSocket protocol, the Mozilla Foundation has decided to disable support for this protocol in the forthcoming Firefox 4 Beta 8 release. The vulnerability in the code for transparent proxies can potentially be exploited to poison the proxy cache and inject manipulated pages.
The Firefox developers only plan to re-enable WebSockets once a new and improved version of the protocol has been released. However, the pertaining code will remain a part of Firefox, and developers can use a hidden option to reactivate the technology for testing. The current version 76 of the protocol is already supported by Chrome and Safari. WebSockets allow permanent connections between clients and servers and enable servers to independently send data to a client. In conventional connections, a client prompts a server to send data via GET or POST.
The Opera developers have also decided to disable WebSockets for security reasons in version 11 of their browser.
- Mozilla releases Firefox 4 Beta 7, a report from The H.
- Mozilla celebrates 6 years of Firefox, a report from The H.
- Mozilla: Firefox 4 delayed until 'early 2011', a report from The H.