Request for Comments: 4622 JSF
Category: Standards Track July 2006
Internationalized Resource Identifiers (IRIs)
and Uniform Resource Identifiers (URIs) for
the Extensible Messaging and Presence Protocol (XMPP)
Status of This Memo
This document specifies an Internet standards track protocol for the
Internet community, and requests discussion and suggestions for
improvements. Please refer to the current edition of the "Internet
Official Protocol Standards" (STD 1) for the standardization state
and status of this protocol. Distribution of this memo is unlimited.
Copyright Notice
Copyright (C) The Internet Society (2006).
Abstract
This document defines the use of Internationalized Resource
Identifiers (IRIs) and Uniform Resource Identifiers (URIs) in
identifying or interacting with entities that can communicate via the
Extensible Messaging and Presence Protocol (XMPP).
Table of Contents
1. Introduction ....................................................3
1.1. Terminology ................................................3
2. Use of XMPP IRIs and URIs .......................................4
2.1. Rationale ..................................................4
2.2. Form .......................................................4
2.3. Authority Component ........................................6
2.4. Path Component .............................................7
2.5. Query Component ............................................7
2.6. Fragment Identifier Component ..............................9
2.7. Generation of XMPP IRIs/URIs ...............................9
2.7.1. Generation Method ...................................9
2.7.2. Generation Notes ...................................10
2.7.3. Generation Example .................................11
2.8. Processing of XMPP IRIs/URIs ..............................12
2.8.1. Processing Method ..................................12
2.8.2. Processing Notes ...................................13
2.8.3. Processing Example .................................14
2.9. Internationalization ......................................14
3. IANA Registration of xmpp URI Scheme ...........................15
3.1. URI Scheme Name ...........................................15
3.2. Status ....................................................15
3.3. URI Scheme Syntax .........................................15
3.4. URI Scheme Semantics ......................................16
3.5. Encoding Considerations ...................................16
3.6. Applications/protocols That Use This URI Scheme Name ......16
3.7. Interoperability Considerations ...........................16
3.8. Security Considerations ...................................16
3.9. Contact ...................................................17
3.10. Author/Change Controller .................................17
3.11. References ...............................................17
4. IANA Considerations ............................................17
5. Security Considerations ........................................17
5.1. Reliability and Consistency ...............................17
5.2. Malicious Construction ....................................18
5.3. Back-End Transcoding ......................................18
5.4. Sensitive Information .....................................18
5.5. Semantic Attacks ..........................................19
5.6. Spoofing ..................................................19
6. References .....................................................20
6.1. Normative References ......................................20
6.2. Informative References ....................................20
1. Introduction
The Extensible Messaging and Presence Protocol (XMPP) is a streaming
XML technology that enables any two entities on a network to exchange
well-defined but extensible XML elements (called "XML stanzas") at a
rate close to real time.
As specified in [XMPP-CORE], entity addresses as used in
communications over an XMPP network must not be prepended with a
Uniform Resource Identifier (URI) scheme (as specified in [URI]).
However, applications external to an XMPP network may need to
identify XMPP entities either as URIs or, in a more modern fashion,
as Internationalized Resource Identifiers (IRIs; see [IRI]).
Examples of such external applications include databases that need to
store XMPP addresses and non-native user agents such as web browsers
and calendaring applications that provide interfaces to XMPP
services.
The format for an XMPP address is defined in [XMPP-CORE]. Such an
address may contain nearly any [UNICODE] character and must adhere to
various profiles of [STRINGPREP]. The result is that an XMPP address
is fully internationalizable and is very close to being an IRI
without a scheme. However, given that there is no freestanding
registry of IRI schemes, it is necessary to define XMPP identifiers
primarily as URIs rather than as IRIs, and to register an XMPP URI
scheme instead of an IRI scheme. Therefore, this document does the
following:
o Specifies how to identify XMPP entities as IRIs or URIs.
o Specifies how to interact with XMPP entities as IRIs or URIs.
o Formally defines the syntax for XMPP IRIs and URIs.
o Specifies how to transform XMPP IRIs into URIs and vice-versa.
o Registers the xmpp URI scheme.
1.1. Terminology
This document inherits terminology from [IRI], [URI], and
[XMPP-CORE].
The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT",
"SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this
document are to be interpreted as described in RFC 2119 [TERMS].
2. Use of XMPP IRIs and URIs
2.1. Rationale
As described in [XMPP-IM], instant messaging and presence
applications of XMPP must handle im: and pres: URIs (as specified by
[CPIM] and [CPP]). However, there are many other applications of
XMPP (including network management, workflow systems, generic
publish-subscribe, remote procedure calls, content syndication,
gaming, and middleware), and these applications do not implement
instant messaging and presence semantics. Neither does a generic
XMPP entity implement the semantics of any existing URI scheme, such
as the http:, ftp:, or mailto: scheme. Therefore, it is appropriate
to define a new URI scheme that makes it possible to identify or
interact with any XMPP entity (not just instant messaging and
presence entities) as an IRI or URI.
XMPP IRIs and URIs are defined for use by non-native interfaces and
applications, and primarily for the purpose of identification rather
than of interaction (on the latter distinction, see Section 1.2.2 of
[URI]). In order to ensure interoperability on XMPP networks, when
data is routed to an XMPP entity (e.g., when an XMPP address is
contained in the ’to’ or ’from’ attribute of an XML stanza) or an
XMPP entity is otherwise identified in standard XMPP protocol
elements, the entity MUST be addressed as <[node@]domain[/resource]>
(i.e., without a prepended scheme), where the "node identifier",
"domain identifier", and "resource identifier" portions of an XMPP
address conform to the definitions provided in Section 3 of
[XMPP-CORE].
(Note: For historical reasons, the term "resource identifier" is used
in XMPP to refer to the optional portion of an XMPP address that
follows the domain identifier and the "/" separator character (for
details, refer to Section 3.4 of [XMPP-CORE]; this use of the term
"resource identifier" is not to be confused with the meanings of
"resource" and "identifier" provided in Section 1.1 of [URI]).
2.2. Form
As described in [XMPP-CORE], an XMPP address used natively on an XMPP
network is a string of Unicode characters that (1) conforms to a
certain set of [STRINGPREP] profiles and [IDNA] restrictions, (2)
follows a certain set of syntax rules, and (3) is encoded as [UTF-8].
The form of such an address can be represented using Augmented
Backus-Naur Form ([ABNF]) as:
[ node "@" ] domain [ "/" resource ]
In this context, the "node" and "resource" rules rely on distinct
profiles of [STRINGPREP], and the "domain" rule relies on the concept
of an internationalized domain name as described in [IDNA]. (Note:
There is no need to refer to punycode in the IRI syntax itself, since
any punycode representation would occur only inside an XMPP
application in order to represent internationalized domain names.
However, it is the responsibility of the processing application to
convert [IRI] syntax into [IDNA] syntax before addressing XML stanzas
to the specified entity on an XMPP network.)
Naturally, in order to be converted into an IRI or URI, an XMPP
address must be prepended with a scheme (specifically, the xmpp
scheme) and may also need to undergo transformations that adhere to
the rules defined in [IRI] and [URI]. Furthermore, in order to
enable more advanced interaction with an XMPP entity rather than
simple identification, it is desirable to take advantage of
additional aspects of URI syntax and semantics, such as authority
components, query components, and fragment identifier components.
Therefore, the ABNF syntax for an XMPP IRI is defined as shown below
using Augmented Backus-Naur Form specified by [ABNF], where the
"ifragment", "ihost", and "iunreserved" rules are defined in [IRI],
the "pct-encoded" rule is defined in [URI], and DQUOTE is defined in
[ABNF]:
xmppiri = "xmpp" ":" ihierxmpp
[ "?" iquerycomp ]
[ "#" ifragment ]
ihierxmpp = iauthpath / ipathxmpp
iauthpath = "//" iauthxmpp [ "/" ipathxmpp ]
iauthxmpp = inodeid "@" ihost
ipathxmpp = [ inodeid "@" ] ihost [ "/" iresid ]
inodeid = *( iunreserved / pct-encoded / nodeallow )
nodeallow = "!" / "$" / "(" / ")" / "*" / "+" / "," / ";" /
"=" / "[" / "\" / "]" / "^" / "`" / "{" / "|" /
"}"
iresid = *( iunreserved / pct-encoded / resallow )
resallow = "!" / DQUOTE / "$" / "&" / "’" / "(" / ")" /
"*" / "+" / "," / ":" / ";" / "<" / "=" / ">" /
"[" / "\" / "]" / "^" / "`" / "{" / "|" / "}"
iquerycomp = iquerytype [ *ipair ]
iquerytype = *iunreserved
ipair = ";" ikey "=" ivalue
ikey = *iunreserved
ivalue = *( iunreserved / pct-encoded )
However, the foregoing syntax is not appropriate for inclusion in the
registration of the xmpp URI scheme, since the IANA recognizes only
URI schemes and not IRI schemes. Therefore, the ABNF syntax for an
XMPP URI rather than for IRI is defined as shown in Section 3.3 of
this document (see below under "IANA Registration"). If it is
necessary to convert the IRI syntax into URI syntax, an application
MUST adhere to the mapping procedure specified in Section 3.1 of
[IRI].
The following is an example of a basic XMPP IRI/URI used for purposes
of identifying a node associated with an XMPP server:
xmpp:node@example.com
Descriptions of the various components of an XMPP IRI/URI are
provided in the following sections.
2.3. Authority Component
As explained in Section 2.8 of this document, in the absence of an
authority component, the processing application would authenticate as
a configured user at a configured XMPP server. That is, the
authority component section is unnecessary and should be ignored if
the processing application has been configured with a set of default
credentials.
In accordance with Section 3.2 of RFC 3986, the authority component
is preceded by a double slash ("//") and is terminated by the next
slash ("/"), question mark ("?"), or number sign ("#") character, or
by the end of the IRI/URI. As explained more fully in Section 2.8.1
of this document, the presence of an authority component signals the
processing application to authenticate as the node@domain specified
in the authority component rather than as a configured node@domain
(see the Security Considerations section of this document regarding
authentication). (While it is unlikely that the authority component
will be included in most XMPP IRIs or URIs, the scheme allows for its
inclusion, if appropriate.) Thus, the following XMPP IRI/URI
indicates to authenticate as "guest@example.com":
xmpp://guest@example.com
Note well that this is quite different from the following XMPP
IRI/URI, which identifies a node "guest@example.com" but does not
signal the processing application to authenticate as that node:
xmpp:guest@example.com
Similarly, using a possible query component of "?message" to trigger
an interface for sending a message, the following XMPP IRI/URI
signals the processing application to authenticate as
"guest@example.com" and to send a message to "support@example.com":
xmpp://guest@example.com/support@example.com?message
By contrast, the following XMPP IRI/URI signals the processing
application to authenticate as its configured default account and to
send a message to "support@example.com":
xmpp:support@example.com?message
2.4. Path Component
The path component of an XMPP IRI/URI identifies an XMPP address or
specifies the XMPP address to which an XML stanza shall be directed
at the end of IRI/URI processing.
For example, the following XMPP IRI/URI identifies a node associated
with an XMPP server:
xmpp:example-node@example.com
The following XMPP IRI/URI identifies a node associated with an XMPP
server along with a particular XMPP resource identifier associated
with that node:
xmpp:example-node@example.com/some-resource
Inclusion of a node is optional in XMPP addresses, so the following
XMPP IRI/URI simply identifies an XMPP server:
xmpp:example.com
2.5. Query Component
There are many potential use cases for encapsulating information in
the query component of an XMPP IRI/URI; examples include but are not
limited to:
o sending an XMPP message stanza (see [XMPP-IM]),
o adding a roster item (see [XMPP-IM]),
o sending a presence subscription (see [XMPP-IM]),
o probing for current presence information (see [XMPP-IM]),
o triggering a remote procedure call (see [JEP-0009]),
o discovering the identity or capabilities of another entity (see
[JEP-0030]),
o joining an XMPP-based text chat room (see [JEP-0045]),
o interacting with publish-subscribe channels (see [JEP-0060]),
o providing a SOAP interface (see [JEP-0072]), and
o registering with another entity (see [JEP-0077]).
Many of these potential use cases are application specific, and the
full range of such applications cannot be foreseen in advance given
the continued expansion in XMPP development; however, there is
agreement within the Jabber/XMPP developer community that all the
uses envisioned to date can be encapsulated via a "query type",
optionally supplemented by one or more "key-value" pairs (this is
similar to the "application/x-www-form-urlencoded" MIME type
described in [HTML]).
As an example, an XMPP IRI/URI intended to launch an interface for
sending a message to the XMPP entity "example-node@example.com" might
be represented as follows:
xmpp:example-node@example.com?message
Similarly, an XMPP IRI/URI intended to launch an interface for
sending a message to the XMPP entity "example-node@example.com" with
a particular subject might be represented as follows:
xmpp:example-node@example.com?message;subject=Hello%20World
If the processing application does not understand query components or
the specified query type, it MUST ignore the query component and
treat the IRI/URI as consisting of, for example,
<xmpp:example-node@example.com> rather than
<xmpp:example-node@example.com?query>. If the processing application
does not understand a particular key within the query component, it
MUST ignore that key and its associated value.
As noted, there exist many kinds of XMPP applications (both actual
and potential), and such applications may define query types and keys
for use in the query component portion of XMPP URIs. The Jabber
Registrar function (see [JEP-0053]) of the Jabber Software Foundation
maintains a registry of such query types and keys at
<http://www.jabber.org/registrar/querytypes.html>. To help ensure
interoperability, any application using the formats defined in this
document SHOULD submit any associated query types and keys to that
registry in accordance with the procedures specified in [JEP-0147].
2.6. Fragment Identifier Component
As stated in Section 3.5 of [URI], "The fragment identifier component
of a URI allows indirect identification of a secondary resource by
reference to a primary resource and additional identifying
information." Because the resource identified by an XMPP IRI/URI
does not make available any media type (see [MIME]) and therefore (in
the terminology of [URI]) no representation exists at an XMPP
resource, the semantics of the fragment identifier component in XMPP
IRIs/URIs are to be "considered unknown and, effectively,
unconstrained" (ibid.). Particular XMPP applications MAY make use of
the fragment identifier component for their own purposes. However,
if a processing application does not understand fragment identifier
components or the syntax of a particular fragment identifier
component included in an XMPP IRI/URI, it MUST ignore the fragment
identifier component.
2.7. Generation of XMPP IRIs/URIs
2.7.1. Generation Method
In order to form an XMPP IRI from an XMPP node identifier, domain
identifier, and resource identifier, the generating application MUST
first ensure that the XMPP address conforms to the rules specified in
[XMPP-CORE], including application of the relevant [STRINGPREP]; it
MUST then concatenate the following:
1. The "xmpp" scheme and the ":" character
2. Optionally (if an authority component is to be included before
the node identifier), the characters "//", an authority component
of the form node@domain, and the character "/".
3. Optionally (if the XMPP address contained an XMPP "node
identifier"), a string of Unicode characters that conforms to the
"inodeid" rule, followed by the "@" character.
4. A string of Unicode characters that conforms to the "ihost" rule.
5. Optionally (if the XMPP address contained an XMPP "resource
identifier"), the character "/" and a string of Unicode
characters that conforms to the "iresid" rule.
6. Optionally (if a query component is to be included), the "?"
character and query component.
7. Optionally (if a fragment identifier component is to be
included), the "#" character and fragment identifier component.
In order to form an XMPP URI from the resulting IRI, an application
MUST adhere to the mapping procedure specified in Section 3.1 of
[IRI].
2.7.2. Generation Notes
Certain characters are allowed in the node identifier, domain
identifier, and resource identifier portions of a native XMPP address
but prohibited by the "inodeid", "ihost", and "iresid" rules of an
XMPP IRI. Specifically, the "#" and "?" characters are allowed in
node identifiers, and the "/", "?", "#", and "@" characters are
allowed in resource identifiers, but these characters are used as
delimiters in XMPP IRIs. In addition, the " " ([US-ASCII] space)
character is allowed in resource identifiers but prohibited in IRIs.
Therefore, all the foregoing characters MUST be percent-encoded when
transforming an XMPP address into an XMPP IRI.
Consider the following nasty node in an XMPP address:
nasty!#$%()*+,-.;=?[\]^_`{|}~node@example.com
That address would be transformed into the following XMPP IRI:
xmpp:nasty!%23$%25()*+,-.;=%3F[\]^_`{|}~node@example.com
Consider the following repulsive resource in an XMPP address (split
into two lines for layout purposes):
node@example.com
/repulsive !#"$%&’()*+,-./:;<=>?@[\]^_`{|}~resource
That address would be transformed into the following XMPP IRI (split
into two lines for layout purposes):
xmpp:node@example.com
/repulsive%20!%23"$%25&’()*+,-.%2F:;<=>%3F%40[\]^_`{|}~resource
Furthermore, virtually any character outside the [US-ASCII] range is
allowed in an XMPP address and therefore also in an XMPP IRI, but URI
syntax forbids such characters directly and specifies that such
characters MUST be percent-encoded. In order to determine the URI
associated
with an XMPP IRI, an application MUST adhere to the mapping procedure
specified in Section 3.1 of [IRI].
2.7.3. Generation Example
Consider the following XMPP address:
<jiři@čechy.example/v Praze>
Note: The string "ř" stands for the Unicode character LATIN
SMALL LETTER R WITH CARON, and the string "č" stands for the
Unicode character LATIN SMALL LETTER C WITH CARON, following the "XML
Notation" used in [IRI] to represent characters that cannot be
rendered in ASCII-only documents (note also that these characters are
represented in their stringprep canonical form). The ’<’ and ’>’
characters are not part of the address itself but are provided to set
off the address for legibility. For those who do not read Czech,
this example could be Anglicized as "george@czech-lands.example/In
Prague".
In accordance with the process specified above, the generating
application would do the following to generate a valid XMPP IRI from
this address:
1. Ensure that the XMPP address conforms to the rules specified in
[XMPP-CORE], including application of the relevant [STRINGPREP]
profiles and encoding as a [UTF-8] string.
2. Concatenate the following:
1. The "xmpp" scheme and the ":" character.
2. An "authority component" if included (not shown in this
example).
3. A string of Unicode characters that represents the XMPP
address, transformed in accordance with the "inodeid",
"ihost", and "iresid" rules.
4. The "?" character followed by a "query component", if
appropriate to the application (not shown in this example).
5. The "#" character followed by a "fragment identifier
component", if appropriate to the application (not shown in
this example).
The result is this XMPP IRI:
<xmpp:jiři@čechy.example/v%20Praze>
In order to generate a valid XMPP URI from the foregoing IRI, the
application MUST adhere to the procedure specified in Section 3.1 of
[IRI], resulting in the following URI:
<xmpp:ji%C5%99i@%C4%8Dechy.example/v%20Praze>
2.8. Processing of XMPP IRIs/URIs
2.8.1. Processing Method
If a processing application is presented with an XMPP URI and not
with an XMPP IRI, it MUST first convert the URI into an IRI by
following the procedure specified in Section 3.2 of [IRI].
In order to decompose an XMPP IRI for interaction with the entity it
identifies, a processing application MUST separate:
1. The "xmpp" scheme and the ":" character.
2. The authority component, if included (the string of Unicode
characters between the "//" characters and the next "/"
character, the "?" character, the "#" character, or the end of
the IRI).
3. A string of Unicode characters that represents an XMPP address as
transformed in accordance with the "inodeid", "ihost", and
"iresid" rules.
4. Optionally the query component, if included, using the "?"
character as a separator.
5. Optionally the fragment identifier component, if included, using
the "#" character as a separator.
At this point, the processing application MUST ensure that the
resulting XMPP address conforms to the rules specified in
[XMPP-CORE], including application of the relevant [STRINGPREP]. The
processing application then would either (1) complete further XMPP
handling itself or (2) invoke a helper application to complete XMPP
handling; such XMPP handling would most likely consist of the
following steps:
1. If not already connected to an XMPP server, connect either as the