update

[camysidron1]

No description provided.

[pi-security-bot]

Protocol Compliance Violation Detected

PR violates OCPP specification by changing WebSocket subprotocol from correct 'ocpp1.6' to incorrect 'ocpp-1.6', which will break protocol negotiation and prevent secure OCPP communication.

Critical Issues

1. Protocol Compliance Violation in src/MicroOcpp.cpp (line 156)

WebSocket subprotocol changed from OCPP-compliant 'ocpp1.6' to non-compliant 'ocpp-1.6'. According to OCPP specification (Table 1), OCPP version 1.6 must use subprotocol name 'ocpp1.6' without hyphen. This will cause WebSocket handshake failures with compliant OCPP backend servers.

webSocket->beginSslWithCA(host.c_str(), port, path.c_str(), CA_cert, "ocpp-1.6");

2. Protocol Compliance Violation in src/MicroOcpp.cpp (line 159)

WebSocket subprotocol changed from OCPP-compliant 'ocpp1.6' to non-compliant 'ocpp-1.6' in non-TLS connection. According to OCPP specification (Table 1), OCPP version 1.6 must use subprotocol name 'ocpp1.6' without hyphen. This will cause WebSocket handshake failures with compliant OCPP backend servers.

webSocket->begin(host.c_str(), port, path.c_str(), "ocpp-1.6");

Analysis

According to the user-provided OCPP guidelines (Table 1: OCPP Versions), the WebSocket subprotocol name for OCPP version 1.6 must be 'ocpp1.6' (without hyphen). This PR changes the protocol string from the correct format to an incorrect format in both TLS and non-TLS WebSocket initialization calls. This compliance violation has security implications because: (1) WebSocket handshake will likely fail when connecting to OCPP-compliant backend servers that expect 'ocpp1.6', (2) Failed protocol negotiation prevents the entire OCPP security framework (authentication, authorization, encrypted communication) from functioning, (3) Chargers will be unable to establish secure connections to backend systems, potentially leaving charging infrastructure inoperable. The code comments in MicroOcpp.h explicitly document 'protocol=ocpp1.6' as the expected format, confirming the current implementation is correct. This change violates the OCPP standard and should not be merged without understanding why the non-compliant format is being introduced.