Websockets or no websockets how to decide?

[cmmacneill]

Hi,

I see the answer to many issues with newer browsers has one of two solutions:-

1. Disable websockets
2. Upgrade to FOP2 v2.27

However, to make an informed decision:-

1. What do we lose, if anything, by disabling websockets? If we lose nothing, then why not make websockets disabled by default?
2. Without websockets is FOP2 falling back to using AJAX/JSON?

Regards

CM (apart from websockets issue, a very happy licensed user of FOP2) 8-)

[nicolas]

Hi,

FOP2 uses two methods for its real time communication protocol (none of them use ajax):

1. flash xmlsockets
2. html5 websockets (since version 2.20)

Flash is widely installed, but it is also becoming obsolete. HTML5 websockets is replacing flash, but it is still evolving and support across browsers is at different levels of "maturity", or even implementation versions. FOP2 will use websockets if the browser supports it.

People that use an old FOP2 version, will have support for an old websockets implementation, the one that was available back at that time, and the one that is still being used by browsers like Safari.

The websocket implementation changed, in a way that is incompatible with previous versions. So if you use a recent version of Google Chrome or Mozilla Firefox, you must upgrade FOP2 too, as the new version of websockets was added to FOP2 when it became available (not at the time version 2.20 was released). This is not a FOP2 flaw, is just that the websocket implementation was changed to a more sophisticated version. If you do not want to upgrade FOP2 either because you do not want to pay for the upgrade, or whatever reason you might have, you should then use a browser that do not support websockets (Internet Explorer 7,8,9), or one where websockets can be disabled at the browser (Mozilla Firefox).

So, for avoiding problems, you should UPGRADE fop2, and try to use websockets if available as it is faster and more secure. But you might have potential issues with browser upgrades as the technology is still evolving and is subject to change.

There are other issues with websockets, as the latest draft mandates that if you connect via https to the web page serving the application, then the websocket connection should be negotiated also using TLS (secure websockets or wss). Secure websockets are available on version 2.27 only in FOP2, and requires extra configuration of certificates in the fop2.cfg file, and many times configuring certificates can be a daunting task. Not to mention that some browsers will refuse a secure websocket connection with self signed certificates (99,9% of users use ssl with self signed certificates). So that implementation in the browser side is still an issue. Firefox is strict about that requirement, while Chrome will let you connect via standard websockets even if you use ssl at the http level (not following the draft/specifications). FOP version 2.27 will use secure web sockets if you connect via https and it will not revert to standard websockets (strict as Firefox), but that makes mandatory the certificate configuration in fop2.cfg.

Do you loose anything by disabling websockets in FOP2? Not much, you will sacrifice a little speed on connection time, and you will be using Adobe Flash. Feature wise is the same. IOS devices do not have flash at all, so you won't be able to connect with an Ipad for example when disabling websockets.

With time, flash will be totally obsolete and unsupported in many platforms, and websockets are their natural evolution.

What do I use myself? Google Chrome, Websockets, via standard HTTP (non ssl) over a VPN.