Subject: "headers" in SIP-URL

From: Shail Bhatnagar <[email-masked]>
Date: Tue, 14 Mar 2000 13:44:42 -0500

A look at the syntax of SIP-URL shows that headers can be defined in a SIP-URL
itself. However, the spec also says they MUST NOT be present in From/To and
Request-URI. Does it mean they can be present in Contact header (the addr-spec
portion of Contact) ?? 
I don't see any good reason for headers being allowed inside a SIP-URL and I
would be curious to know how many implementations actually introduce it in
SIP-URL ( probably the Contact header) and rely on it.

Thanks,

-- 
Best regards,
Shail

---

From: Henning Schulzrinne <[email-masked]>
Date: Tue, 14 Mar 2000 13:51:59 -0500

> SIP-URL ( probably the Contact header) and rely on it.

In a redirect, you can play tricks such as adding new headers to the
next, redirected call. (For example, the redirect server could provide
the password for another call.) While I doubt that it is used right now,
it seems like a feature worth having around.

-- 
Henning Schulzrinne   http://www.cs.columbia.edu/~hgs

---

From: Igor Slepchin <[email-masked]>
Date: Tue, 14 Mar 2000 14:19:09 -0500

I actually used this in Siphone: you could include something like
mailto:[email-masked]?Subject="I'm OOO, use email" in a
redirect response and then the UAC would pop up a mail composer with the
Subject line filled in (just a little boasting:)

Back to the point: headers may also be quite useful when embedding SIP
URLs in web pages; the RFC actually has an example of such a URL.

---
Igor Slepchin

---

From: Shail Bhatnagar <[email-masked]>
Date: Tue, 14 Mar 2000 14:29:13 -0500

> it seems like a feature worth having around.

Are these headers copied to the next request - as long as one of the following
is not specified :
Call-ID, From, To and CSeq, Via ??

Any security issues with this ??

Thanks,
Shail

---

From: Jonathan Rosenberg <[email-masked]>
Date: Wed, 15 Mar 2000 03:29:55 -0500

> > it seems like a feature worth having around.

It has tons of uses, actually. One example is debit card calling; a user
calls a number, is authenticated to some system, and is then redirected
(or transferred), with the Contact in the redirect containing either an
Authorization header, or even a body with some kind of token (like an
OSP token). I would definitely recommend that people implement this.

> Call-ID, From, To and CSeq, Via ??

Hmmm; this is a good question. I believe a client should generally copy
all of them. I know of several cool services which require Call-ID,
From, To and CSeq to be copied. The only possible exception is Via and
Contact, since then the response (and subsequent requests) may not get
back if this is not formulated correctly. However, I suppose that if a
server redirects and puts a Via in the redirect URL, its just asking for
trouble, and shouldn't complain if the service doesn't work. So, copy
them all.

> Any security issues with this ??

There are certainly interesting attacks that can be launched by
redirecting people to URLs with various headers placed in there.
However, I think these are all solved by making sure to authenticate a
redirect response.

I think we might want to comment in the revised spec, in the section on
Contact, about handling of headers in URLs.

-Jonathan R.
-- 
Jonathan D. Rosenberg                       200 Executive Drive
Chief Scientist                             Suite 120 
dynamicsoft                                 West Orange, NJ 07052
[email-masked]                     FAX:   (732) 741-4778
http://www.cs.columbia.edu/~jdrosen         PHONE: (732) 741-7244
http://www.dynamicsoft.com