Jfriend00 comments have excellent links to good info ...
I want to point out a few obvious ones to show that masking unencrypted connections on web sockets is a necessary requirement , and not just useful:
Proxies, routers and other intermediaries (for example, Internet providers) often read requests sent by the client and “fix” any problems, add headers and otherwise “optimize” (for example, respond to the cache) the consumption of network resources.
Some headers and request types (such as Connect ) are often routed to these brokers rather than to the destination server.
Since many of these devices are older and unaware of the Websockets protocol, transparent text that resembles an HTTP request can be edited.
Therefore, it is necessary that the clear text be “shifted” to unrecognized bytes in order to initiate a “pass” rather than a “processing”.
After this point, it was only about using disguise to make sure that hackers did not “cancel” this disguise to send malicious frames.
As for the wss requirement instead of disguise - I know that this was considered at the time of writing the standard ... but until the certificates are free, any web standard that requires SSL / TLS, usually a “rich person” than the Internet, will do it decision.
As for "why mask wss data?" “I'm not sure about that, but I suspect it is designed to allow the parser to be a connected agnostic and easier to write.” In clear text, unoiled frames represent a protocol error and result in a server initiated shutdown. The presence of the parser behaves the same regardless of the connection, it allows you to separate the parser from the raw I / O layer, making it agnostic and offering support for event-based programming.