From the RFC 6455:
.. the server has to prove to the client that it received the client's WebSocket handshake, so that the server doesn't accept connections that are not WebSocket connections. This prevents an attacker from tricking a WebSocket server by sending it carefully crafted packets using XMLHttpRequest [XMLHttpRequest] or a form submission.
... For this header field, the server has to take the value (as present in the header field, e.g., the base64-encoded [RFC4648] version minus any leading and trailing whitespace) and concatenate this with the Globally Unique Identifier (GUID, [RFC4122]) "258EAFA5-E914-47DA- 95CA-C5AB0DC85B11" in string form, which is unlikely to be used by network endpoints that do not understand the WebSocket Protocol.
- What is the purpose of concatenating the GUID?
How is it any more unlikely that concatenating with the GUID, then obtaining the hash, instead of just obtaining the hash, that other network endpoints will get confused? It seems to me that the GUID part of the handshake is abundant, if not strange. It does not add to randomness or anything else.
- Why SHA-1? Why not some less computationally expensive hash as this has nothing to do with security?