Subject: [xmpp] #24: optionality of 'from' on stream header for clients

From: "xmpp issue tracker" <[email-masked]>
Date: Mon, 14 Jun 2010 20:58:35 -0000

#24: optionality of 'from' on stream header for clients
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |       Owner:  stpeter@…         
     Type:  defect              |      Status:  new               
 Priority:  minor               |   Milestone:                    
Component:  3920bis             |     Version:                    
 Severity:  In WG Last Call     |    Keywords:                    
--------------------------------+-------------------------------------------
 Section 4.4.1 states:

 > For initial stream headers in client-to-server communication,
 > if the client knows the XMPP identity of the principal
 > controlling the client (typically an account name of the form
 > <localpart@domain>), then it MAY include the 'from'
 > attribute and set its value to that identity.

 Waqas Hussain commented: "This could be fairly useful, but isn't very
 useful as a MAY (very few clients bother to support this)."

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/24>
xmpp <http://tools.ietf.org/xmpp/>

---

From: "xmpp issue tracker" <[email-masked]>
Date: Fri, 25 Jun 2010 02:56:39 -0000

#24: optionality of 'from' on stream header for clients
--------------------------------+-------------------------------------------
 Reporter:  stpeter@…           |        Owner:  stpeter@…         
     Type:  defect              |       Status:  closed            
 Priority:  minor               |    Milestone:                    
Component:  3920bis             |      Version:                    
 Severity:  In WG Last Call     |   Resolution:  fixed             
 Keywords:                      |  
--------------------------------+-------------------------------------------
Changes (by stpeter@…):

  * status:  new => closed
  * resolution:  => fixed

Comment:

 Resolved by changing MAY to SHOULD.

-- 
Ticket URL: <http://trac.tools.ietf.org/wg/xmpp/trac/ticket/24#comment:1>
xmpp <http://tools.ietf.org/xmpp/>

---

From: Kevin Smith <[email-masked]>
Date: Sun, 27 Jun 2010 22:06:09 +0100

> #24: optionality of 'from' on stream header for clients

This now means that the client is transmitting its identity in plain
text. If its willing to do SASL without TLS, this may be fine - but if
we assume the client won't be willing to do SASL without TLS, it's
reasonable that it would not be willing to send the client identity
either. Perhaps we would say something along the lines of
"SHOULD include the 'from' attribute and set its value to that
identity +once the stream is in a state in which it is willing to
perform authentication, e.g. once TLS has been negotiated"
I think this still gives the benefits waqas speaks of, without leaking
identity to eavesdroppers.

/K

---

From: Peter Saint-Andre <[email-masked]>
Date: Sun, 27 Jun 2010 15:14:14 -0600

> perform authentication, e.g. once TLS has been negotiated"

WFM

/psa