客户端必须在它发送到服务器的所有帧中添加掩码（Mask）

在WebSocket协议中，数据是通过一系列数据帧来进行传输的。为了避免由于网络中介（例如一些拦截代理）或者一些在第10.3节讨论的安全原因，客户端必须在它发送到服务器的所有帧中添加掩码（Mask）（具体细节见5.3节）。（注意：无论WebSocket协议是否使用了TLS，帧都需要添加掩码）。服务端收到没有添加掩码的数据帧以后，必须立即关闭连接。在这种情况下，服务端可以发送一个在7.4.1节定义的状态码为1002（协议错误）的关闭帧。服务端禁止在发送数据帧给客户端时添加掩码。客户端如果收到了一个添加了掩码的帧，必须立即关闭连接。在这种情况下，它可以使用第7.4.1节定义的1002（协议错误）状态码。（这些规则可能会在将来的规范中放开）。

基础的数据帧协议使用操作码、有效负载长度和在“有效负载数据”中定义的放置“扩展数据”与“引用数据”的指定位置来定义帧类型。特定的bit位和操作码为将来的协议扩展做了保留。

一个数据帧可以在开始握手完成之后和终端发送了一个关闭帧之前的任意一个时间通过客户端或者服务端进行传输（第5.5.1节）。

 

5. Data Framing

5.1. Overview

   In the WebSocket Protocol, data is transmitted using a sequence of
   frames.  To avoid confusing network intermediaries (such as
   intercepting proxies) and for security reasons that are further
   discussed in Section 10.3, a client MUST mask all frames that it
   sends to the server (see Section 5.3 for further details).  (Note
   that masking is done whether or not the WebSocket Protocol is running
   over TLS.)  The server MUST close the connection upon receiving a
   frame that is not masked.  In this case, a server MAY send a Close
   frame with a status code of 1002 (protocol error) as defined in
   Section 7.4.1.  A server MUST NOT mask any frames that it sends to
   the client.  A client MUST close a connection if it detects a masked
   frame.  In this case, it MAY use the status code 1002 (protocol
   error) as defined in Section 7.4.1.  (These rules might be relaxed in
   a future specification.)

   The base framing protocol defines a frame type with an opcode, a
   payload length, and designated locations for "Extension data" and
   "Application data", which together define the "Payload data".
   Certain bits and opcodes are reserved for future expansion of the
   protocol.

Fette & Melnikov             Standards Track                   [Page 27]

---

RFC 6455                 The WebSocket Protocol            December 2011

   A data frame MAY be transmitted by either the client or the server at
   any time after opening handshake completion and before that endpoint
   has sent a Close frame (Section 5.5.1).

RFC 6455 - The WebSocket Protocol https://tools.ietf.org/html/rfc6455#section-5.1