This JEP defines a binding of Jabber/XMPP communications to a transport layer of HTTP rather than TCP.
WARNING: This Standards-Track JEP is Experimental. Publication as a Jabber Enhancement Proposal does not imply approval of this proposal by the Jabber Software Foundation. Implementation of the protocol described herein is encouraged in exploratory implementations, but production systems should not deploy implementations of this protocol until it advances to a status of Draft.
Status: Experimental
Type: Standards Track
Number: 0124
Version: 0.8
Last Updated: 2004-10-26
JIG: Standards JIG
Approving Body: Jabber Council
Dependencies: XMPP Core, RFC 1945, RFC 2068, RFC 3174
Supersedes: None
Superseded By: None
Short Name: httpbind
Email: dizzyd@jabber.org
JID: dizzyd@jabber.org
Email: stpeter@jabber.org
JID: stpeter@jabber.org
Email: ian.paterson@clientside.co.uk
JID: ian@zoofy.com
This Jabber Enhancement Proposal is copyright 1999 - 2004 by the Jabber Software Foundation (JSF) and is in full conformance with the JSF's Intellectual Property Rights Policy <http://www.jabber.org/jsf/ipr-policy.php>. This material may be distributed only subject to the terms and conditions set forth in the Open Publication License, v1.0 or later (the latest version is presently available at <http://www.opencontent.org/openpub/>).
The preferred venue for discussion of this document is the Standards-JIG discussion list: <http://mail.jabber.org/mailman/listinfo/standards-jig>.
Given that this JEP normatively references IETF technologies, discussion on the JSF-IETF list may also be appropriate (see <http://mail.jabber.org/mailman/listinfo/jsf-ietf> for details).
The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core and XMPP IM specifications contributed by the Jabber Software Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocols defined in this JEP have been developed outside the Internet Standards Process and are to be understood as extensions to XMPP rather than as an evolution, development, or modification of XMPP itself.
The keywords "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119.
XMPP Core [1] defines XML streams bound to TCP (see RFC 793 [2]) as the standard transport layer for Jabber/XMPP communications. However, the binding of XMPP to TCP is not always feasible because of client runtime environment and/or network constraints. This JEP describes the usage of the Hypertext Transfer Protocol (HTTP, see RFC 2068 [3] and RFC 1945 [4]) as an alternative transport binding that supports such constrained environments, normally via deployment of a specialized server-side connection manager that communicates with clients via HTTP rather than TCP.
Before the authors pursued publication of this JEP, other approaches were explored. One possible approach might have been to apply state to a series of HTTP transactions via HTTP "cookies" as specified in RFC 2965 [5]. However, there are several significant computing platforms which provide only limited access to underlying HTTP requests/responses; worse, some platforms hide or remove cookie-related headers. Therefore the cookie approach was rejected.
Another approach might have been to modify or extend Jabber HTTP Polling [6]. This informational protocol has been used by Jabber clients without runtime constraints to access XMPP servers from behind firewalls. Unfortunately, the method defined in JEP-0025 also depends on cookies, does not meet most of the requirements described below, and cannot be extended without breaking all existing implementations.
Therefore, this JEP specifies a new way of transporting XMPP via HTTP. All information is encoded in the body of standard HTTP POST requests and responses. Each HTTP body contains a single <body/> XML wrapper element (not to be confused with the <body/> child of the <message/> stanza as defined in XMPP IM [7]), which encapsulates zero or more XML stanzas.
Although this JEP documents some XMPP-specific features, the binding is not part of XMPP. In fact, the protocol is extensible and could be used to implement any bidirectional stream of XML stanzas.
This document inherits terminology regarding the Hypertext Transport Protocol from RFCs 1945 and 2068.
Platform limitiations, security restrictions, and other constraints imply that many clients can connect to Internet resources (e.g., Jabber servers) only via HTTP. The following design requirements reflect the need to offer performance as close as possible to a standard TCP connection.
Compatibility with constrained runtime environments implies the following restrictions:
The binding of XMPP to HTTP assumes a different architecture from that described for the binding of XMPP to TCP as defined in XMPP Core. In particular, because HTTP is not the native binding for XMPP, we assume that most XMPP implementations will utilize a specialized "connection manager" to handle HTTP connections rather than the usual TCP connections. Effectively, such a connection manager will be a specialized HTTP server that translates between the HTTP requests and responses defined herein and the XML streams (or a server API) implemented by the XMPP server or servers with which it communicates, thus enabling an HTTP client to connect to an XMPP server. We can illustrate this graphically as follows:
XMPP Server
|
| [XML streams or server API]
|
Connection Manager
|
| [HTTP + <body/> wrapper]
|
HTTP Client
This JEP addresses communications between an HTTP client and the connection manager only. It does not address communications between the connection manager and the XMPP server, since such communications are implementation-specific (e.g., the connection manager and the XMPP server may use Jabber Component Protocol [8] or an API defined by the XMPP server implementation in order to communicate; alternatively, the XMPP server may natively support the HTTP binding, in which case the connection manager will be a logical entity rather than a physical entity).
Furthermore, no aspect of the HTTP binding limits its use to client-to-server communications; i.e., it could be used for server-to-server or component-to-server communications as well (probably through a slight change to the XML schema). However, this document focuses exclusively on use of the HTTP binding by clients that cannot maintain persistent TCP connections to a server and that therefore cannot use the TCP binding defined in XMPP Core. We assume that servers and components are under no such restrictions and thus would use the TCP binding.
Clients SHOULD send HTTP requests over persistent HTTP/1.1 connections. However, a constrained client MAY open a new HTTP/1.0 connection (as defined in RFC 1945) to send each request.
Requests and responses MAY include HTTP headers not specified herein. The receiver SHOULD ignore any such headers.
The body of each HTTP request and response contains a single <body/> wrapper element. The <body/> element MUST contain zero or more complete XML elements. It MUST NOT contain partial XML elements.
If the <body/> wrapper element is not empty, then it MUST contain one of the following:
Note: Inclusion of TLS negotiation elements is allowed but is NOT RECOMMENDED (see below).
The <body/> wrapper element SHOULD be qualified by the 'http://jabber.org/protocol/httpbind' namespace, and child elements SHOULD be qualified by their respective namespaces (e.g., 'http://etherx.jabber.org/streams' for stream features, 'urn:ietf:params:xml:ns:xmpp-sasl' for SASL negotiation, and 'jabber:client' for XML stanzas). However, even if the client does not specify the namespaces, the connection manager MUST ensure that the XMPP it provides to the XMPP server or other entities on the network meets the namespacing requirements of XMPP Core.
The <body/> element of every client request MUST possess a sequential request ID encapsulated via the 'rid' attribute. The client MUST generate a large positive non-zero random integer for the first 'rid' and then increment that value by one for each subsequent request. For details, refer to the Request IDs section below.
The first request from the client to the connection manager creates a new session.
The <body/> element of the first request SHOULD possess the following attributes:
Note: Clients that only support polling behavior MAY prevent the connection manager from waiting by setting 'wait' or 'hold' to "0". However, polling is NOT RECOMMENDED since the associated increase in bandwidth consumption and the decrease in responsiveness are typically one or two orders of magnitude!
Some clients are constrained to only accept HTTP responses with specific Content-Types (e.g., "text/html"). The <body/> element of the first request MAY possess a 'content' attribute. This specifies the value of the HTTP Content-Type header that MUST appear in all the connection manager's responses during the session. If the client request does not possess a 'content' attribute, then the HTTP Content-Type of responses MUST be "text/xml; charset=utf-8".
Note: The HTTP Content-Type of client requests SHOULD also be "text/xml; charset=utf-8". Clients MAY specify another value if they are constrained to do so (e.g., "application/x-www-form-urlencoded" or "text/plain"). The client and connection manager SHOULD ignore all HTTP Content-Type headers they receive. The connection manager is not required to convert between UTF-8 and other character encodings. For both requests and responses, the <body/> element and its content SHOULD be UTF-8 encoded, even if the HTTP Content-Type header specifies a different charset.
Example 1. Requesting an HTTP session
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 104
<body content='text/xml; charset=utf-8'
hold='1'
rid='3197423130'
to='jabber.org'
wait='60'
xml:lang='en'
xmlns='http://jabber.org/protocol/httpbind'/>Note: Unlike the protocol defined in JEP-0025, an opening <stream:stream> tag is not sent. The protocol defined herein abstracts from XML streams between the connection manager and the client. Any XML streams between the connection manager and an XMPP server are the responsibility of the connection manager.
Note: All requests after the first one MUST include a valid 'sid' attribue (provided by the connection manager in the session creation response below). The initialization request is unique in that the <body/> element MUST NOT possess a 'sid' attribute.
After receiving a new session request, the connection manager MUST generate an opaque, unpredictable session identifier (or SID). The SID MUST be unique within the context of the connection manager application. The connection manager then returns that SID to the client in a response <body/> element.
The connection manager MUST specify a 'wait' attribute. This is the longest time (in seconds) that it will wait before responding to any request during the session. The time MUST be less than or equal to the value specified in the session request.
The connection manager MAY limit the number of simultaneous requests the client makes with the 'requests' attribute. The RECOMMENDED value is "2". Servers that only support polling behavior MUST prevent clients from making simultaneous requests by setting the 'requests' attribute to a value of "1" (however, polling is NOT RECOMMENDED). In any case, clients MUST NOT make more simultaneous requests than specified by the connection manager.
The connection manager SHOULD include two additional attributes in the session creation response element, specifying the shortest allowable polling interval and the longest allowable inactivity period (both in seconds). Communication of these parameters enables the client to engage in appropriate behavior (e.g., not sending empty request elements more often than desired, and ensuring that the periods with no requests pending are never too long).
Example 2. Session creation response
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 128
<body authid='ServerStreamID'
wait='60'
inactivity='30'
polling='5'
requests='2'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'/>Note: The 'authid' attribute contains the value of the XMPP stream ID generated by the XMPP server. The connection manager MUST retrieve the stream ID and pass it unmodified to the client. This value is needed by the client to successfully complete digest authentication using Non-SASL Authentication [10] (see the jabber:iq:auth section below).
Note: If the 'authid' attribute is not included in the connection manager's response to the session creation request (e.g., because the connection manager has not yet received a stream ID from the XMPP server), then the client SHOULD send empty request elements (see the "Requesting XML Stanzas" example below) until it receives a response with an 'authid' attribute. In any case, the connection manager MUST return the 'authid' in a response to the client as soon as possible after it receives the stream ID from the XMPP server.
Separate 'sid' and 'authid' attributes are required because the connection manager is not necessarily part of a single XMPP server (e.g., it may handle HTTP connections on behalf of multiple XMPP servers).
As an immediate child of the session creation response, the connection manager MAY include a stream features element, as defined by XMPP Core.
Example 3. Session creation response with stream features
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 417
<body wait='60'
inactivity='60'
polling='5'
requests='2'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<stream:features xmlns='http://etherx.jabber.org/streams'>
<mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
<mechanism>DIGEST-MD5</mechanism>
<mechanism>PLAIN</mechanism>
</mechanisms>
<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
<session xmlns='urn:ietf:params:xml:ns:xmpp-session'>
</stream:features>
</body>The stream features SHOULD NOT include a feature for Transport Layer Security (TLS), since channel encryption SHOULD be negotiated at the HTTP layer (see the Security Considerations section below).
Initializing an HTTP session is the first precondition to sending XML message, presence, and IQ stanzas. However, before processing XML stanzas from the client, the connection manager MUST require completion of additional preconditions using either of the following methods:
XMPP authentication, resource binding, and IM session creation, in the following order:
Simultaneous authentication and resource binding as defined in Non-SASL Authentication, upon which a Jabber server will also establish an IM session on behalf of the connected resource.
It is RECOMMENDED to use the XMPP methods as defined in XMPP Core and XMPP IM, rather than using older non-SASL authentication.
A success case for authentication, resource binding, and IM session establishment using the XMPP protocols is shown below. For detailed specification of these protocols (including error cases) and for specification of TLS negotiation, refer to XMPP Core and XMPP IM.
Example 4. SASL authentication step 1
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 172
<body rid='3197423131'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='DIGEST-MD5'/>
</body>Example 5. SASL authentication step 2
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 250
<body xmlns='http://jabber.org/protocol/httpbind'>
<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
cmVhbG09InNvbWVyZWFsbSIsbm9uY2U9Ik9BNk1HOXRFUUdtMmhoIixxb3A9
ImF1dGgiLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNzCg==
</challenge>
</body>Example 6. SASL authentication step 3
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 418
<body rid='3197423132'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
dXNlcm5hbWU9InNvbWVub2RlIixyZWFsbT0ic29tZXJlYWxtIixub25jZT0i
T0E2TUc5dEVRR20yaGgiLGNub25jZT0iT0E2TUhYaDZWcVRyUmsiLG5jPTAw
MDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InhtcHAvZXhhbXBsZS5jb20i
LHJlc3BvbnNlPWQzODhkYWQ5MGQ0YmJkNzYwYTE1MjMyMWYyMTQzYWY3LGNo
YXJzZXQ9dXRmLTgK
</response>
</body>Example 7. SASL authentication step 4
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 190
<body xmlns='http://jabber.org/protocol/httpbind'>
<challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
cnNwYXV0aD1lYTQwZjYwMzM1YzQyN2I1NTI3Yjg0ZGJhYmNkZmZmZAo=
</challenge>
</body>Example 8. SASL authentication step 5
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 152
<body rid='3197423133'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
</body>Example 9. SASL authentication step 6
HTTP/1.1 200 OK Content-Type: text/xml; charset=utf-8 Content-Length: 121 <body xmlns='http://jabber.org/protocol/httpbind'> <success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/> </body>
Note: Because the context for a client's communication with a connection manager in the HTTP transport binding is HTTP rather than XML streams (as in the TCP binding), there is no need to re-start communications (e.g., by generating a new SID) at this point.
Example 10. Resource binding request
POST /webclient HTTP/1.1
Content-Type: text/xml; charset=utf-8
Content-Length: 240
<body rid='3197423134'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<iq id='bind_1'
type='set'
xmlns='jabber:client'>
<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
<resource>httpclient</resource>
</bind>
</iq>
</body>Example 11. Resource binding result
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 221
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq id='bind_1'
type='result'
xmlns='jabber:client'>
<bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
<jid>stpeter@jabber.org/httpclient</jid>
</bind>
</iq>
</body>Example 12. IM session request
POST /webclient HTTP/1.1
Content-Type: text/xml; charset=utf-8
Content-Length: 261
<body rid='3197423135'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<iq from='stpeter@jabber.org/httpclient'
id='sess_1'
to='jabber.org'
type='set'
xmlns='jabber:client'>
<session xmlns='urn:ietf:params:xml:ns:xmpp-session'/>
</iq>
</body>Example 13. IM session result
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 175
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq from='jabber.org'
id='sess_1'
to='stpeter@jabber.org/httpclient'
type='result'
xmlns='jabber:client'/>
</body>A success case for simultaneous authentication, resource binding, and IM session creation using the original "jabber:iq:auth" protocol is shown below. For further details regarding use of this protocol, refer to JEP-0078. If digest authentication is used, then the stream ID value used to compute the hashed password MUST be the value of the 'authid' attribute provided by the connection manager in the response to the initialization element or in a subsequent response (see the Session Creation section above).
Example 14. Non-SASL authentication request
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 281
<body rid='2842791421'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<iq id='A01'
type='set'
xmlns='jabber:client'>
<query xmlns='jabber:iq:auth'>
<username>stpeter</username>
<resource>httpclient</resource>
<password>jabber-rocks</password>
</query>
</iq>
</body>Example 15. Authentication result (success)
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 144
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq id='A01'
type='result'
xmlns='jabber:client'/>
</body>Example 16. Authentication result (failure)
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 226
<body xmlns='http://jabber.org/protocol/httpbind'>
<iq id='A01'
type='error'
xmlns='jabber:client'>
<error code='401' type='auth'>
<not-authorized xmlns='urn:ietf:params:xml:ns:xmpp-stanzas'/>
</error>
</iq>
</body>After the client has successfully completed all required preconditions, it can send and receive XML stanzas via the HTTP binding.
Example 17. Transmitting stanzas
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 188
<body rid='2842791422'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'>
<message to='contact@example.com'
xmlns='jabber:client'>
<body>Hi there!</body>
</message>
<message to='friend@example.com'
xmlns='jabber:client'>
<body>Hi there!</body>
</message>
</body>Upon receipt of a request, the connection manager MUST forward the content of the <body/> element to the XMPP server as soon as possible. However, it must forward the content from different requests in the order specified by their 'rid' attributes.
The connection manager MUST also return an HTTP 200 OK response with a <body/> element to the client. Note: This does not indicate that the stanzas have been successfully delivered to the destination Jabber endpoint.
It is RECOMMENDED that the connection manager not return an HTTP result until a stanza has arrived from the XMPP server for delivery to the client. However, the connection manager SHOULD NOT wait longer than the time specified by the client in the 'wait' attribute of its session creation request, and it SHOULD NOT keep more HTTP requests waiting at a time than the number specified in the 'hold' attribute of the session creation request. In any case it MUST respond to requests in the order specified by their 'rid' attributes.
If there are no stanzas waiting or ready to be delivered within the waiting period, then the connection manager SHOULD include an empty <body/> element in the HTTP result:
Example 18. Empty response
HTTP/1.1 200 OK Content-Type: text/xml; charset=utf-8 Content-Length: 64 <body xmlns='http://jabber.org/protocol/httpbind'/>
If the connection manager has received one or more stanzas from the XMPP server for delivery to the client, then it SHOULD return the stanzas in the body of its response as soon as possible after receiving them from the XMPP server.
Example 19. Response with queued stanza
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 185
<body xmlns='http://jabber.org/protocol/httpbind'>
<message from='contact@example.com'
to='user@example.com'
xmlns='jabber:client'>
<body>Hi yourself!</body>
</message>
<message from='friend@example.com'
to='user@example.com'
xmlns='jabber:client'>
<body>Hi yourself!</body>
</message>
</body>The client MAY poll the connection manager for incoming stanzas by sending an empty <body/> element.
Example 20. Requesting XML Stanzas
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 88
<body rid='2842791423'
sid='SomeSID'
xmlns='http://jabber.org/protocol/httpbind'/>The connection manager MUST wait and respond in the same way as it does after receiving stanzas from the client.
If the client sends two consecutive empty requests within a period shorter than that specified by the 'polling' attribute in the session creation response, then the connection manager SHOULD terminate the HTTP session and return an HTTP 403 (Forbidden) error to the client.
Example 21. Too frequent polling response
HTTP/1.1 403 Forbidden Content-Type: text/xml; charset=utf-8 Content-Length: 0
If the connection manager did not specify a shortest allowable polling interval in the session creation response, then it MUST allow the client to poll as frequently as it chooses.
After receiving a response from the connection manager, if no other requests are pending and the client did not specify polling behavior in the session creation request (by setting 'wait' or 'hold' to "0"), it SHOULD make a new request as soon as possible. In any case, if no requests are pending, the client MUST make a new request before the maximum inactivity period has expired. This period is specified by the 'inactivity' attribute in the session creation response.
If the connection manager has responded to all the requests it has received and the time since its last response is longer than the maximum inactivity period, then it SHOULD terminate the session without informing the client (if the client makes another request, the connection manager SHOULD respond as if the session does not exist).
If the connection manager did not specify a maximum inactivity period in the session creation response, then it MUST allow the client to be inactive for as long as it chooses.
At any time, the client MAY gracefully terminate the session by sending a <body/> element with a 'type' attribute set to "terminate". The termination request SHOULD include an XMPP presence stanza of type "unavailable" to ensure graceful logoff with the XMPP server.
Example 22. Session termination by client
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 153
<body rid='2842791424'
sid='SomeSID'
type='terminate'
xmlns='http://jabber.org/protocol/httpbind'>
<presence type='unavailable'
xmlns='jabber:client'/>
</body>The connection manager SHOULD return an HTTP 200 OK response with an empty <body/> element. Upon receiving the response, the client MUST consider the HTTP session to have been terminated.
When a client makes simultaneous requests, the connection manager may receive them out of order. The connection manager MUST forward the stanzas to the XMPP server and respond to the client requests in the order specified by the 'rid' attributes. The client MUST process responses received from the connection manager in the order the requests were made.
The connection manager SHOULD expect the 'rid' attribute to be within a window of values greater than the 'rid' of the previous request. The size of the window is equal to the maximum number of simultaneous requests allowed by the connection manager. If it receives a request with a 'rid' greater than the values in the window, then the connection manager MUST terminate the session with an error:
Example 23. Unexpected rid error
HTTP/1.1 401 Unauthorized Content-Type: text/xml; charset=utf-8 Content-Length: 0
Unreliable network communications or client constraints can result in broken connections. The connection manager SHOULD remember the 'rid' and the associated HTTP response body of the client's most recent requests which did not result in an HTTP or binding error. The number of responses kept in the buffer should be the same as the maximum number of simultaneous requests allowed by the connection manager.
If the network connection is broken or closed before the client receives a response to a request from the connection manager, then the client MAY resend an exact copy of the original request. Whenever the connection manager receives a request with a 'rid' that it has already received, it SHOULD return an HTTP 200 (OK) response that includes the buffered copy of the original XML response to the client (i.e., a <body/> wrapper element possessing appropriate attributes and optionally containing one or more XML stanzas or other allowable XML elements). If the original response is not available (e.g., it is no longer in the buffer), then the connection manager MUST return an HTTP 401 (Unauthorized) error:
Example 24. Response not in buffer error
HTTP/1.1 401 Unauthorized Content-Type: text/xml; charset=utf-8 Content-Length: 0
Note: The error is the same whether the 'rid' is too large or too small. This makes it more difficult for an attacker to discover an acceptable value.
The OPTIONAL key sequencing mechanism described here MAY be used if the client's session with the connection manager is not secure. The session should be considered secure only if all client requests are made via TLS/SSL HTTP connections and the connection manager generates an unpredictable session ID. If the session is secure, it is not necessary to use this key sequencing mechanism.
Even if the session is not secure, the unpredictable session and request IDs specified in the preceding sections of this document already provide a level of protection similar to that provided by a standard XMPP connection bound to a single pair of persistent TCP/IP connections, and thus provide sufficient protection against a 'blind' attacker. However, in some circumstances, the key sequencing mechanism defined below helps to protect against a more determined and knowledgeable attacker.
It is important to recognize that the key sequencing mechanism defined below helps to protect only against an attacker who is able to view the contents of all requests or responses in an insecure session but who is not able to alter the contents of those requests (in this case, the mechanism prevents the attacker from interjecting HTTP requests into the session, e.g., termination requests or responses). However, the key sequencing mechanism does not provide any protection when the attacker is able to alter the contents of insecure requests or responses.
The HTTP requests of each session MAY be spread across a series of different socket connections. This would enable an unauthorized user that obtains the session ID and request ID of a session and then use their own socket connection to interject <body/> request elements into the session and receive the corresponding responses.
The key sequencing mechanism below protects against such attacks by enabling a connection manager to detect <body/> request elements interjected by a third party.
Prior to requesting a new session, the client MUST select an unpredictable counter ("n") and an unpredictable value ("seed"). The client then processes the "seed" through a cryptographic hash and converts the resulting 160 bits to a hexadecimal string K(1). It does this "n" times to arrive at the initial key K(n). The hashing algorithm MUST be SHA-1 as defined in RFC 3174 [11].
Example 25. Creating the key sequence
K(1) = hex(SHA-1(seed))
K(2) = hex(SHA-1(K(1)))
...
K(n) = hex(SHA-1(K(n-1)))
The client MUST set the 'newkey' attribute of the first request in the session to the value K(n).
Example 26. Session Request with Initial Key
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 104
<body content='text/xml; charset=utf-8'
hold='1'
rid='3197423130'
to='jabber.org'
wait='60'
xml:lang='en'
newkey='ca393b51b682f61f98e7877d61146407f3d0a770'
xmlns='http://jabber.org/protocol/httpbind'/>The client MUST set the 'key' attribute of all subsequent requests to the value of the next key in the generated sequence (decrementing from K(n-1) towards K(1) with each request sent).
Example 27. Request with Key
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 88
<body rid='3197423131'
sid='SomeSID'
key='bfb06a6f113cd6fd3838ab9d300fdb4fe3da2f7d'
xmlns='http://jabber.org/protocol/httpbind'/>The connection manager MAY verify the key by calculating the SHA-1 hash of the key and comparing it to the 'newkey' attribute of the previous request (or the 'key' attribute if the 'newkey' attribute was not set). If the values do not match (or if it receives a request without a 'key' attribute and the 'newkey' or 'key' attribute of the previous request was set), then the connection manager MUST NOT process the element, MUST terminate the session, and MUST return an HTTP 401 (Unauthorized) error.
Example 28. Invalid Key Sequence Error
HTTP/1.1 401 Unauthorized Content-Type: text/xml; charset=utf-8 Content-Length: 0
A client SHOULD choose a high value for "n" when generating the key sequence. However, if the session lasts long enough that the client arrives at the last key in the sequence K(1) then the client MUST switch to a new key sequence.
The client MUST:
Example 29. New Key Sequence
POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Content-Type: text/xml; charset=utf-8
Content-Length: 188
<body rid='3197423132'
sid='SomeSID'
key='6f825e81f4532b2c5fa2d12457d8a1f22e8f838e'
newkey='113f58a37245ec9637266cf2fb6e48bfeaf7964e'
xmlns='http://jabber.org/protocol/httpbind'>
<message to='contact@example.com'
xmlns='jabber:client'>
<body>Hi there!</body>
</message>
</body>There are four types of error and status reporting in HTTP responses:
Table 1: Error Condition Types
| Condition Type | Description |
|---|---|
| HTTP Conditions | The connection manager responds to an invalid client request with a standard HTTP error. These are used for binding syntax errors, possible attacks, etc. Note that constrained clients are unable to differentiate between HTTP errors. |
| Terminal Binding Conditions | These error conditions may be read by constrained clients. They are used for connection manager problems, abstracting stream errors, and communication problems between the connection manager and the XMPP server. |
| Recoverable Binding Conditions | These report communication problems between the connection manager and the client. They do not terminate the session. Clients recover from these errors by resending the last two <body/> wrapper elements. |
| XMPP Stanza Conditions | XMPP errors relating to XML stanzas within <body/> wrapper elements are, in general, defined in the appropriate RFC or JEP. They do not terminate the session. An example of such usage is shown above in relation to Non-SASL Authentication. |
Full descriptions are provided below.
The following HTTP error and status codes are used in particular ways by this protocol (other HTTP error and status codes may be used as appropriate). Upon receiving an HTTP error (200, 400, 401, 403), the HTTP client MUST consider the HTTP session to be null and void.
Note: These are pure HTTP codes as defined in the HTTP specification, and are not to be confused with the HTTP-style error codes traditionally used in Jabber protocols and documented in Error Condition Mappings [12].
Table 2: HTTP Error and Status Codes
| Code | Name | Purpose |
|---|---|---|
| 200 | OK | Response to valid client request. |
| 400 | Bad Request | Inform client that the format of an HTTP header or binding element is unacceptable (e.g., syntax error). |
| 401 | Unauthorized | Inform client that (1) 'sid' is not valid, (2) 'rid' is larger than the upper limit of the expected window, (3) connection manager is unable to resend response, (4) 'key' sequence is invalid. |
| 403 | Forbidden | Inform client that it has broken the session rules (polling too-frequently, too many simultaneous connections). |
In any response it sends to the client, the connection manager MAY return a fatal error by setting a 'type' attribute of the <body/> element to "terminate". These binding errors imply that the HTTP session is terminated. (Note: Many of these conditions correspond to the relevant XMPP stream error conditions specified in XMPP Core, but actual XMPP stream error conditions experienced between the connection manager and the server are contained only in the "remote-stream-error" condition as described below.)
Example 30. Remote connection failed error
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 68
<body type='terminate'
condition='remote-connection-failed'
xmlns='http://jabber.org/protocol/httpbind'/>The following values of the 'condition' attribute are defined:
Table 3: Binding Error Conditions
| Condition | Purpose |
|---|---|
| host-gone | The target hostname specified in the 'to' attribute is no longer serviced by the connection manager. |
| host-unknown | The target hostname specified in the 'to' attribute is unknown to the connection manager. |
| improper-addressing | The initialization element lacks a 'to' attribute (or the attribute has no value) but the connection manager requires one. |
| internal-server-error | The connection manager has experienced an internal error that prevents it from servicing the request. |
| other-request | Another request being processed at the same time as this request caused the session to terminate. |
| remote-connection-failed | The connection manager was unable to connect to, or has lost its connection to, the XMPP server. |
| remote-stream-error | Encapsulates an XMPP stream error. The content of the binding is a copy of the content of the <stream:error/> element received from the XMPP server. |
| see-other-uri | The connection manager does not operate at this URI (e.g., the connection manager accepts only SSL/TLS connections at some https: URI rather than the http: URI requested by the client). The client may try POSTing to the URI in the content of the <uri/> child element. |
| system-shutdown | The connection manager is being shut down. All active HTTP sessions are being terminated. No new sessions can be created. |
| undefined-condition | The error is not one of those defined herein; the connection manager SHOULD include application-specific information in the content of the <body/> wrapper element. |
The following is an example of a "see-other-uri" condition:
Example 31. See other URI error
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 68
<body condition='see-other-uri'
type='terminate'
xmlns='http://jabber.org/protocol/httpbind'>
<uri>https://secure.jabber.org/xmppcm</uri>
</body>The following is an example of a "remote-stream-error" condition:
Example 32. Remote error
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 68
<body condition='remote-stream-error'
type='terminate'
xmlns='http://jabber.org/protocol/httpbind'>
<xml-not-well-formed xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>
<text xmlns='urn:ietf:params:xml:ns:xmpp-streams'
xml:lang='en'>
Some special application diagnostic information!
</text>
<escape-your-data xmlns='application-ns'/>
</body>Naturally, the client MAY report binding errors to the connection manager as well, although this is unlikely.
In any response it sends to the client, the connection manager MAY return a recoverable error by setting a 'type' attribute of the <body/> element to "error". These errors do not imply that the HTTP session is terminated.
If it decides to recover from the error, then the client MUST repeat the HTTP request and the previous HTTP request. The content of both requests MUST be identical to the <body/> elements of the original requests. This allows the server to recover a session after the previous request was lost due to a communication failure.
Example 33. Recoverable error
HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 68
<body type='error'
xmlns='http://jabber.org/protocol/httpbind'/>Application-level error conditions will normally be generated by a third entity (e.g., an IM contact) and routed to the client through the connection manager; therefore they are out of scope for the transport binding defined herein and are described in the appropriate RFC or JEP.
However, it is possible that a connection manager will receive a stanza for delivery to a client even though the client connection is no longer active (e.g., before the connection manager is able to inform a server that the connection has died). In this case, the connection manager would return an error to the server; it is RECOMMENDED that the connection manager proceed as follows, since the situation is similar to that addressed by point #2 of Section 11.1 of XMPP IM:
When a server receives a <message/> stanza of type "error" containing a <recipient-unavailable/> condition from a connection manager, it SHOULD store the message for later delivery if offline storage is enabled, otherwise route the error stanza to the sender.
Communications SHOULD occur over an encrypted channel. Negotiation of channel encryption SHOULD occur at the HTTP layer, not the application layer; such negotiation SHOULD follow the protocol defined in RFC 2817 [13].
The session identifier (SID) and initial request identifier (RID) are security-critical and therefore MUST be both unpredictable and nonrepeating (see RFC 1750 [14] for recommendations regarding randomness of SIDs and initial RIDs for security purposes).
This JEP requires no interaction with the Internet Assigned Numbers Authority (IANA) [15].
Upon advancement of this proposal to a status of Draft, the Jabber Registrar [16] shall add 'http://jabber.org/protocol/httpbind' to its registry of protocol namespaces.
<?xml version='1.0' encoding='UTF-8'?>
<xs:schema
xmlns:xs='http://www.w3.org/2001/XMLSchema'
xmlns:stream='http://etherx.jabber.org/streams'
targetNamespace='http://jabber.org/protocol/httpbind'
xmlns='http://jabber.org/protocol/httpbind'
elementFormDefault='qualified'>
<xs:import namespace='http://etherx.jabber.org/streams'
schemaLocation='http://etherx.jabber.org/streams.xsd'/>
<xs:element name='body'>
<xs:complexType>
<xs:choice xmlns:stream='http://etherx.jabber.org/streams'>
<xs:element ref='stream:features'
minOccurs='0'
maxOccurs='1'/>
<xs:any namespace='urn:ietf:params:xml:ns:xmpp-tls'
minOccurs='0'
maxOccurs='1'/>
<xs:any namespace='urn:ietf:params:xml:ns:xmpp-sasl'
minOccurs='0'
maxOccurs='1'/>
<xs:any namespace='urn:ietf:params:xml:ns:xmpp-streams'
minOccurs='0'
maxOccurs='1'/>
<xs:any namespace='jabber:client'
minOccurs='0'
maxOccurs='unbounded'/>
<xs:element name='uri'
minOccurs='0'
maxOccurs='1'
type='xs:string'/>
</xs:choice>
<xs:attribute name='authid' type='xs:string' use='optional'/>
<xs:attribute name='condition' use='optional'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='host-gone'/>
<xs:enumeration value='host-unknown'/>
<xs:enumeration value='improper-addressing'/>
<xs:enumeration value='internal-server-error'/>
<xs:enumeration value='remote-connection-failed'/>
<xs:enumeration value='remote-stream-error'/>
<xs:enumeration value='see-other-uri'/>
<xs:enumeration value='system-shutdown'/>
<xs:enumeration value='undefined-condition'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='content' type='xs:string' use='optional'/>
<xs:attribute name='hold' type='xs:byte' use='optional'/>
<xs:attribute name='inactivity' type='xs:byte' use='optional'/>
<xs:attribute name='key' type='xs:string' use='optional'/>
<xs:attribute name='newkey' type='xs:string' use='optional'/>
<xs:attribute name='polling' type='xs:byte' use='optional'/>
<xs:attribute name='requests' type='xs:byte' use='optional'/>
<xs:attribute name='rid' type='xs:string' use='optional'/>
<xs:attribute name='sid' type='xs:string' use='optional'/>
<xs:attribute name='to' type='xs:string' use='optional'/>
<xs:attribute name='type' type='xs:string' use='optional'>
<xs:simpleType>
<xs:restriction base='xs:NCName'>
<xs:enumeration value='error'/>
<xs:enumeration value='terminate'/>
</xs:restriction>
</xs:simpleType>
</xs:attribute>
<xs:attribute name='wait' type='xs:byte' use='optional'/>
<xs:attribute name='xml:lang' type='xs:string' use='optional'/>
</xs:complexType>
</xs:element>
</xs:schema>
1. RFC 3920: Extensible Messaging and Presence Protocol (XMPP): Core <http://www.ietf.org/rfc/rfc3920.txt>.
2. RFC 793: Transmission Control Protocol <http://www.ietf.org/rfc/rfc0793.txt>.
3. RFC 2068: Hypertext Transport Protocol -- HTTP/1.1 <http://www.ietf.org/rfc/rfc2068.txt>.
4. RFC 1945: Hypertext Transfer Protocol -- HTTP/1.0 <http://www.ietf.org/rfc/rfc1945.txt>.
5. RFC 2965: HTTP State Management Mechanism <http://www.ietf.org/rfc/rfc2965.txt>.
6. JEP-0025: Jabber HTTP Polling <http://www.jabber.org/jeps/jep-0025.html>.
7. RFC 3921: Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence <http://www.ietf.org/rfc/rfc3921.txt>.
8. JEP-0114: Jabber Component Protocol <http://www.jabber.org/jeps/jep-0114.html>.
9. Extensible Markup Language (XML) 1.0 (Third Edition) <http://www.w3.org/TR/REC-xml/>.
10. JEP-0078: Non-SASL Authentication <http://www.jabber.org/jeps/jep-0078.html>.
11. RFC 3174: US Secure Hash Algorithm 1 (SHA1) <http://www.ietf.org/rfc/rfc3174.txt>.
12. JEP-0086: Error Condition Mappings <http://www.jabber.org/jeps/jep-0086.html>.
13. RFC 2817: Upgrading to TLS Within HTTP/1.1 <http://www.ietf.org/rfc/rfc2817.txt>.
14. RFC 1750: Randomness Recommendations for Security <http://www.ietf.org/rfc/rfc1750.txt>.
15. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.
16. The Jabber Registrar maintains a list of reserved Jabber protocol namespaces as well as registries of parameters used in the context of protocols approved by the Jabber Software Foundation. For further information, see <http://www.jabber.org/registrar/>.
END