• HTTP Authentication
  
• HTTPS
• Cookie

• http://username:password@www.example.com/...
• Authorization: Basic base64(username:password)

GET /secret.html HTTP/1.1Host: www.example.comAuthorization: Basic QWxhZGRpbjpvcGVuIHNlc2FtZQ==...

• Identification Verification
• Cerification
• Data encryption
• Asymmetric encryption
  
• Symmetric encryption
  

> GET /index.html HTTP/1.1> Host: www.example.org
< HTTP/1.1 200 OK< Content-Type: text/html< Set-Cookie: name=value< Set-Cookie: name2=value2; Expires=Wed, 09 Jun 2021 12:34:56 GMT
> GET /spec.html HTTP/1.1> Host: www.example.org> Cookie: name=value; name2=value2

• Protocol
• Handshake Challenge
• Data Masking

GET /chat HTTP/1.1Host: www.example.comOrigin: http://www.example.comUpgrade: websocketConnection: UpgradeSec-WebSocket-Key: dGhIHNhbXBsZSBub25jZQ==Sec-WebSocket-Protocol: chat, superchatSec-WebSocket-Version: 13

HTTP/1.1 101 Switching ProtocolsUpgrade: websocketConnection: UpgradeSec-WebSocket-Accept: s3pPLMBiTxaQ9kYGzzhZRbK+xOo=Sec-WebSocket-Protocol: chat

• Sec-WebSocket-Key
• Sec-WebSocket-Accept

GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11';Sec-WebSocket-Accept = base64( sha1( Sec-WebSocketKey + GUID ));

  0               1               2               3
  0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7 0 1 2 3 4 5 6 7
 +-+-+-+-+-------+-+-------------+------------------------------+
 |F|R|R|R| Opcode|M| Payload len |    Extended payload length   |
 |I|S|S|S|  (4)  |A|     (7)     |          (16 or 64)          |
 |N|V|V|V|       |S|             |  (if payload len == 126/127) |
 | |1|2|3|       |K|             |                              |
 +-+-+-+-+-------+-+-------------+------------------------------+
 |    Extended payload length continued, if payload len == 127  |
 +-------------------------------+------------------------------+
 |                               |Masking-key, if MASK set to 1 |
 +-------------------------------+------------------------------+
 |     Masking-key continued     |        Payload Data          |
 +-------------------------------+------------------------------+
 :                   Payload Data continued ...                 :
 +--------------------------------------------------------------+
 |                   Payload Data continued ...                 |
 +--------------------------------------------------------------+

• MaskedPayload[i] = Payload[i] ^ Mask[i%4]
  
• Payload[i] = MaskedPayload[i] ^ Mask[i%4]

• Spy the traffic
• Man-in-the-middle
• Hijack iPhone