XEP-0206: XMPP Over BOSH

This specification defines how the Bidirectional-streams Over Synchronous HTTP (BOSH) technology may be used to transport XMPP stanzas. The result is an HTTP binding for XMPP communications that is useful in situations where a device or client is unable to maintain a long-lived TCP connection to an XMPP server.

NOTICE: The protocol defined herein is a Draft Standard of the XMPP Standards Foundation. Implementations are encouraged and the protocol is appropriate for deployment in production systems, but some changes to the protocol are possible before it becomes a Final Standard.

Document Information

Author Information

Ian Paterson

Email: ian.paterson@clientside.co.uk
JabberID: ian@zoofy.com

Legal Notices

Copyright

Permissions

Permission is hereby granted, free of charge, to any person obtaining a copy of this specification (the "Specification"), to make use of the Specification without restriction, including without limitation the rights to implement the Specification in a software program, deploy the Specification in a network service, and copy, modify, merge, publish, translate, distribute, sublicense, or sell copies of the Specification, and to permit persons to whom the Specification is furnished to do so, subject to the condition that the foregoing copyright notice and this permission notice shall be included in all copies or substantial portions of the Specification. Unless separate permission is granted, modified works that are redistributed shall not contain misleading information regarding the authors, title, number, or publisher of the Specification, and shall not claim endorsement of the modified works by the authors, any organization or project to which the authors belong, or the XMPP Standards Foundation.

Disclaimer of Warranty

## NOTE WELL: This Specification is provided on an "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. In no event shall the XMPP Standards Foundation or the authors of this Specification be liable for any claim, damages, or other liability, whether in an action of contract, tort, or otherwise, arising from, out of, or in connection with the Specification or the implementation, deployment, or other use of the Specification. ##

Limitation of Liability

In no event and under no legal theory, whether in tort (including negligence), contract, or otherwise, unless required by applicable law (such as deliberate and grossly negligent acts) or agreed to in writing, shall the XMPP Standards Foundation or any author of this Specification be liable for damages, including any direct, indirect, special, incidental, or consequential damages of any character arising out of the use or inability to use the Specification (including but not limited to damages for loss of goodwill, work stoppage, computer failure or malfunction, or any and all other commercial damages or losses), even if the XMPP Standards Foundation or such author has been advised of the possibility of such damages.

IPR Conformance

This XMPP Extension Protocol has been contributed in full conformance with the XSF's Intellectual Property Rights Policy (a copy of which may be found at <http://www.xmpp.org/extensions/ipr-policy.shtml> or obtained by writing to XSF, P.O. Box 1641, Denver, CO 80201 USA).

Discussion Venue

Relation to XMPP

The Extensible Messaging and Presence Protocol (XMPP) is defined in the XMPP Core (RFC 3920) and XMPP IM (RFC 3921) specifications contributed by the XMPP Standards Foundation to the Internet Standards Process, which is managed by the Internet Engineering Task Force in accordance with RFC 2026. Any protocol defined in this document has been developed outside the Internet Standards Process and is to be understood as an extension to XMPP rather than as an evolution, development, or modification of XMPP itself.

Conformance Terms

The following keywords as used in this document are to be interpreted as described in RFC 2119: "MUST", "SHALL", "REQUIRED"; "MUST NOT", "SHALL NOT"; "SHOULD", "RECOMMENDED"; "SHOULD NOT", "NOT RECOMMENDED"; "MAY", "OPTIONAL".

1. Introduction
2. <body/> Wrapper Element
3. Session Creation Request
4. Session Creation Response
5. Authentication, Resource Binding, and IM Session Establishment
6. remote-stream-error
7. <recipient-unavailable/>
8. Security Considerations
9. IANA Considerations
10. XMPP Registrar Considerations
10.1. Protocol Namespaces
11. XML Schema
Notes
Revision History

1. Introduction

The BOSH [1] protocol defines how arbitrary XML elements may be transported efficiently and reliably over HTTP in both directions between a client and server. This document defines some minor extensions to that protocol that enable XMPP streams (as specified in RFC 3920 [2] and RFC 3921 [3]) to be bound to HTTP.

2. <body/> Wrapper Element

If the BOSH <body/> wrapper is not empty, then it SHOULD contain one of the following:

Note: Many existing XMPP-specific implementations of BOSH clients and connection managers do not specify the namespace of <message/>, <presence/>, or <iq/> elements, since that allows them to forward stanzas without modification (the XMPP <stream:stream/> wrapper element used with TCP typically sets the default namespace to 'jabber:client'). They instead simply assume that the full content of the 'jabber:client' namespace is a subset of the 'http://jabber.org/protocol/httpbind' namespace.

Note: Inclusion of TLS negotiation elements is allowed but is NOT RECOMMENDED. The definition of how TLS might be implemented over BOSH is currently beyond the scope of this document.

3. Session Creation Request

The client SHOULD include a 'xmpp:version' attribute qualified by the 'urn:xmpp:xbosh' namespace in its session creation request. This attribute corresponds to the 'version' attribute of the XMPP <stream:stream/> element as defined in RFC 3920. The connection manager SHOULD forward the value to the XMPP server accordingly.

POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Accept-Encoding: gzip, deflate
Content-Type: text/xml; charset=utf-8
Content-Length: 104

<body content='text/xml; charset=utf-8'
      hold='1'
      rid='1573741820'
      to='jabber.org'
      route='xmpp:jabber.org:9999'
      secure='true'
      wait='60'
      xml:lang='en'
      xmpp:version='1.0'
      xmlns='http://jabber.org/protocol/httpbind'
      xmlns:xmpp='urn:xmpp:xbosh'/>

Note: Unlike the protocol defined in Jabber HTTP Polling [4], an opening <stream:stream> tag is not sent to the connection manager (since BOSH <body/> elements MUST not contain partial XML elements). Any XML streams between the connection manager and an XMPP server are the responsibility of the connection manager (and beyond the scope of this document).

4. Session Creation Response

The connection manager SHOULD include a 'xmpp:version' attribute (qualified by the 'urn:xmpp:xbosh' namespace) and a <stream:features/> element (qualified by the 'http://etherx.jabber.org/streams' namespace) in a response as soon as they are available, either in its session creation response, or (if it has not yet received them from the XMPP server) in any subsequent response. If no <stream:features/> element is included in the connection manager's session creation response, then the client SHOULD send empty request elements until it receives a response containing a <stream:features/> element.

Note: The same procedure applies to the deprecated XMPP-specific 'authid' attribute of the BOSH <body/> element which contains the value of the XMPP stream ID generated by the XMPP server. This value is needed only by legacy XMPP clients in order to complete digest authentication using the deprecated Non-SASL Authentication [5] protocol. [6]

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 674

<body wait='60'
      inactivity='30'
      polling='5'
      requests='2'
      hold='1'
      accept='deflate,gzip'
      sid='SomeSID'
      secure='true'
      charsets='ISO_8859-1 ISO-2022-JP'
      xmpp:version='1.0'
      authid='ServerStreamID'
      xmlns='http://jabber.org/protocol/httpbind'
      xmlns:xmpp='urn:xmpp:xbosh'
      xmlns:stream='http://etherx.jabber.org/streams'>
  <stream:features>
    <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
      <mechanism>DIGEST-MD5</mechanism>
      <mechanism>PLAIN</mechanism>
    </mechanisms>
  </stream:features>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 483

<body xmpp:version='1.0'
      authid='ServerStreamID'
      xmlns='http://jabber.org/protocol/httpbind'
      xmlns:xmpp='urn:xmpp:xbosh'
      xmlns:stream='http://etherx.jabber.org/streams'>
  <stream:features>
    <mechanisms xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
      <mechanism>DIGEST-MD5</mechanism>
      <mechanism>PLAIN</mechanism>
    </mechanisms>
  </stream:features>
</body>

Note: The client SHOULD ignore any Transport Layer Security (TLS) feature since BOSH channel encryption SHOULD be negotiated at the HTTP layer.

TLS compression (as defined in RFC 3920) and Stream Compression (as defined in Stream Compression [7]) are NOT RECOMMENDED since compression SHOULD be negotiated at the HTTP layer and using the 'accept' attribute of the BOSH session creation response. TLS compression and Stream Compression SHOULD NOT be used at the same time as HTTP content encoding.

Note: The 'xmpp:version' attribute SHOULD also be included on the request and response when adding new streams to a session.

5. Authentication, Resource Binding, and IM Session Establishment

A success case for authentication, resource binding, and IM session establishment using the XMPP protocols is shown below. For detailed specification of these protocols (including error cases), refer to RFC 3920 and RFC 3921.

POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Accept-Encoding: gzip, deflate
Content-Type: text/xml; charset=utf-8
Content-Length: 172

<body rid='1573741821'
      sid='SomeSID'
      xmlns='http://jabber.org/protocol/httpbind'>
  <auth xmlns='urn:ietf:params:xml:ns:xmpp-sasl' mechanism='DIGEST-MD5'/>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 250

<body xmlns='http://jabber.org/protocol/httpbind'>
  <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
    cmVhbG09InNvbWVyZWFsbSIsbm9uY2U9Ik9BNk1HOXRFUUdtMmhoIixxb3A9
    ImF1dGgiLGNoYXJzZXQ9dXRmLTgsYWxnb3JpdGhtPW1kNS1zZXNzCg==
  </challenge>
</body>

POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Accept-Encoding: gzip, deflate
Content-Type: text/xml; charset=utf-8
Content-Length: 418

<body rid='1573741822'
      sid='SomeSID'
      xmlns='http://jabber.org/protocol/httpbind'>
  <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
    dXNlcm5hbWU9InNvbWVub2RlIixyZWFsbT0ic29tZXJlYWxtIixub25jZT0i
    T0E2TUc5dEVRR20yaGgiLGNub25jZT0iT0E2TUhYaDZWcVRyUmsiLG5jPTAw
    MDAwMDAxLHFvcD1hdXRoLGRpZ2VzdC11cmk9InhtcHAvZXhhbXBsZS5jb20i
    LHJlc3BvbnNlPWQzODhkYWQ5MGQ0YmJkNzYwYTE1MjMyMWYyMTQzYWY3LGNo
    YXJzZXQ9dXRmLTgK
  </response>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 190

<body xmlns='http://jabber.org/protocol/httpbind'>
  <challenge xmlns='urn:ietf:params:xml:ns:xmpp-sasl'>
    cnNwYXV0aD1lYTQwZjYwMzM1YzQyN2I1NTI3Yjg0ZGJhYmNkZmZmZAo=
  </challenge>
</body>

POST /webclient HTTP/1.1
Host: httpcm.jabber.org
Accept-Encoding: gzip, deflate
Content-Type: text/xml; charset=utf-8
Content-Length: 152

<body rid='1573741823'
      sid='SomeSID'
      xmlns='http://jabber.org/protocol/httpbind'>
  <response xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 121

<body xmlns='http://jabber.org/protocol/httpbind'>
  <success xmlns='urn:ietf:params:xml:ns:xmpp-sasl'/>
</body>

Upon receiving the <success/> element, the client SHOULD then ask the connection manager to restart the stream. It does this by setting to "true" the 'xmpp:restart' attribute (qualified by the 'urn:xmpp:xbosh' namespace) of the BOSH <body/> element. Note: The client SHOULD also include 'to' and 'xml:lang' attributes in its request:

POST /webclient HTTP/1.1
Content-Type: text/xml; charset=utf-8
Content-Length: 240

<body rid='1573741824'
      sid='SomeSID'
      to='jabber.org'
      xml:lang='en'
      xmpp:restart='true'
      xmlns='http://jabber.org/protocol/httpbind'
      xmlns:xmpp='urn:xmpp:xbosh'/>

Upon receiving any request with the 'xmpp:restart' attribute set to "true" the connection manager SHOULD consider the original stream with the XMPP server to be closed (it is not necessary to send a closing </stream:stream> tag). It SHOULD then initiate a new stream by sending an opening <stream:stream> tag over the same TCP connection to the XMPP server. Upon receiving the response from the XMPP server, it SHOULD forward any available features (or an empty element) to the client:

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 221

<body xmlns='http://jabber.org/protocol/httpbind'
      xmlns:stream='http://etherx.jabber.org/streams'>
  <stream:features>
    <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'/>
  </stream:features>
</body>

POST /webclient HTTP/1.1
Content-Type: text/xml; charset=utf-8
Content-Length: 240

<body rid='1573741825'
      sid='SomeSID'
      xmlns='http://jabber.org/protocol/httpbind'>
  <iq id='bind_1'
      type='set'
      xmlns='jabber:client'>
    <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
      <resource>httpclient</resource>
    </bind>
  </iq>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 221

<body xmlns='http://jabber.org/protocol/httpbind'>
  <iq id='bind_1'
      type='result'
      xmlns='jabber:client'>
    <bind xmlns='urn:ietf:params:xml:ns:xmpp-bind'>
      <jid>stpeter@jabber.org/httpclient</jid>
    </bind>
  </iq>
</body>

POST /webclient HTTP/1.1
Content-Type: text/xml; charset=utf-8
Content-Length: 261

<body rid='1573741826'
      sid='SomeSID'
      xmlns='http://jabber.org/protocol/httpbind'>
  <iq from='stpeter@jabber.org/httpclient'
      id='sess_1'
      to='jabber.org'
      type='set'
      xmlns='jabber:client'>
    <session xmlns='urn:ietf:params:xml:ns:xmpp-session'/>
  </iq>
</body>

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 175

<body xmlns='http://jabber.org/protocol/httpbind'>
  <iq from='jabber.org'
      id='sess_1'
      to='stpeter@jabber.org/httpclient'
      type='result'
      xmlns='jabber:client'/>
</body>

6. remote-stream-error

The content of the <body/> element is zero or more stanzas followed by a copy of the <stream:error/> element [8] (qualified by the 'http://etherx.jabber.org/streams' namespace) received from the XMPP server:

HTTP/1.1 200 OK
Content-Type: text/xml; charset=utf-8
Content-Length: 68

<body condition='remote-stream-error'
      type='terminate'
      xmlns='http://jabber.org/protocol/httpbind'
      xmlns:stream='http://etherx.jabber.org/streams'>
  <message from='contact@example.com'
           to='user@example.com'
           xmlns='jabber:client'>
    <body>Hi yourself!</body>
  </message>
  <stream:error>
    <xml-not-well-formed xmlns='urn:ietf:params:xml:ns:xmpp-streams'/>
    <text xmlns='urn:ietf:params:xml:ns:xmpp-streams'
          xml:lang='en'>
      Some special application diagnostic information!
    </text>
    <escape-your-data xmlns='application-ns'/>
  </stream:error>
</body>

7. <recipient-unavailable/>

It is possible that a connection manager will receive a stanza for delivery to a client even though the client connection is no longer active (e.g., before the connection manager is able to inform the XMPP server that the connection has died). In this case, the connection manager would return an error to the XMPP server; it is RECOMMENDED that the connection manager proceed as follows, since the situation is similar to that addressed by point #2 of Section 11.1 of RFC 3921:

When an XMPP server receives a <message/> stanza of type "error" containing a <recipient-unavailable/> condition from a connection manager, it SHOULD store the message for later delivery if offline storage is enabled, otherwise route the error stanza to the sender.

8. Security Considerations

This protocol does not introduce any new security considerations beyond those specified in BOSH.

9. IANA Considerations

10. XMPP Registrar Considerations

10.1 Protocol Namespaces

The XMPP Registrar [10] includes 'urn:xmpp:xbosh' in its registry of protocol namespaces.

11. XML Schema

<?xml version='1.0' encoding='UTF-8'?>

<xs:schema
    xmlns:xs='http://www.w3.org/2001/XMLSchema'
    targetNamespace='urn:xmpp:xbosh'
    xmlns='urn:xmpp:xbosh'
    elementFormDefault='qualified'>

  <xs:annotation>
    <xs:documentation>
      The protocol documented by this schema is defined in
      XEP-0206: http://www.xmpp.org/extensions/xep-0206.html
    </xs:documentation>
  </xs:annotation>

  <xs:import namespace='http://etherx.jabber.org/streams'
             schemaLocation='http://www.xmpp.org/schemas/streams.xsd'/>

  <xs:element name='body'>
    <xs:complexType>
      <xs:choice xmlns:stream='http://etherx.jabber.org/streams'>
        <xs:element ref='stream:features'
                minOccurs='0'
                maxOccurs='1'/>
        <xs:element ref='stream:error'
                minOccurs='0'
                maxOccurs='1'/>
        <xs:any namespace='urn:ietf:params:xml:ns:xmpp-sasl'
                minOccurs='0'
                maxOccurs='1'/>
        <xs:any namespace='jabber:client'
                minOccurs='0'
                maxOccurs='unbounded'/>
        <xs:element name='uri'
                minOccurs='0'
                maxOccurs='1'
                type='xs:string'/>
        <xs:any namespace='##any'
                minOccurs='0'
                maxOccurs='unbounded'
                processContents='lax'/>
      </xs:choice>
      <xs:attribute name='restart' type='xs:boolean' use='optional' default='false'/>
      <xs:attribute name='version' type='xs:string' use='optional' default='1.0'/>
      <xs:anyAttribute namespace='##any' processContents='lax'/>
    </xs:complexType>
  </xs:element>

</xs:schema>

Notes

1. XEP-0124: Bidirectional-streams Over Synchronous HTTP <http://www.xmpp.org/extensions/xep-0124.html>.

2. RFC 3920: Extensible Messaging and Presence Protocol (XMPP): Core <http://tools.ietf.org/html/rfc3920>.

3. RFC 3921: Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence <http://tools.ietf.org/html/rfc3921>.

4. XEP-0025: Jabber HTTP Polling <http://www.xmpp.org/extensions/xep-0025.html>.

5. XEP-0078: Non-SASL Authentication <http://www.xmpp.org/extensions/xep-0078.html>.

6. Separate 'sid' and 'authid' attributes are required because the connection manager is not necessarily part of a single XMPP server (e.g., it may handle HTTP connections on behalf of multiple XMPP servers).

7. XEP-0138: Stream Compression <http://www.xmpp.org/extensions/xep-0138.html>.

8. Earlier obsolete versions of this protocol specified that the <body/> element should contain only the content of the <stream:error/> element.

9. The Internet Assigned Numbers Authority (IANA) is the central coordinator for the assignment of unique parameter values for Internet protocols, such as port numbers and URI schemes. For further information, see <http://www.iana.org/>.

10. The XMPP Registrar maintains a list of reserved protocol namespaces as well as registries of parameters used in the context of XMPP extension protocols approved by the XMPP Standards Foundation. For further information, see <http://www.xmpp.org/registrar/>.