user specified in the authority component or as the configured
user at the configured XMPP server, normally by adhering to the
XMPP connection procedures defined in [XMPP-CORE]. (Note: The
processing application SHOULD ignore the authority component if
it has been configured with a set of default credentials.)
2. Optionally, determine the nature of the intended recipient (e.g.,
via [JEP-0030]).
3. Optionally, present an appropriate interface to a user based on
the nature of the intended recipient and/or the contents of the
query component.
4. Generate an XMPP stanza that translates any user or application
inputs into their corresponding XMPP equivalents.
5. Send the XMPP stanza via the authenticated server connection for
delivery to the intended recipient.
2.8.2. Processing Notes
It may help implementors to note that the first two steps of "further
XMPP handling", as described at the end of Section 2.8.1, are similar
to HTTP authentication ([HTTP-AUTH]), while the next three steps are
similar to the handling of mailto: URIs ([MAILTO]).
As noted in Section 2.7.2 of this document, certain characters are
allowed in the node identifier, domain identifier, and resource
identifier portions of a native XMPP address but prohibited by the
"inodeid", "ihost", and "iresid" rules of an XMPP IRI. The
percent-encoded octets corresponding to these characters in XMPP IRIs
MUST be transformed into the characters allowed in XMPP addresses
when processing an XMPP IRI for interaction with the represented XMPP
entity.
Consider the following nasty node in an XMPP IRI:
xmpp:nasty!%23$%()*+,-.;=%3F[\]^_`{|}~node@example.com
That IRI would be transformed into the following XMPP address:
nasty!#$%()*+,-.;=?[\]^_`{|}~node@example.com
Consider the following repulsive resource in an XMPP IRI (split into
two lines for layout purposes):
xmpp:node@example.com
/repulsive%20!%23"$%25&’()*+,-.%2F:;<=>%3F%40[\]^_`{|}~resource
That IRI would be transformed into the following XMPP address (split
into two lines for layout purposes):
node@example.com
/repulsive !#"$%&’()*+,-./:;<=>?@[\]^_`{|}~resource
2.8.3. Processing Example
Consider the XMPP URI that resulted from the previous example:
<xmpp:ji%C5%99i@%C4%8Dechy.example/v%20Praze>
In order to generate a valid XMPP IRI from that URI, the application
MUST adhere to the procedure specified in Section 3.2 of [IRI],
resulting in the following IRI:
<xmpp:jiři@čechy.example/v%20Praze>
In accordance with the process specified above, the processing
application would remove the "xmpp" scheme and ":" character to
extract the XMPP address from this XMPP IRI, converting any
percent-encoded octets from the "inodeid", "ihost", and "iresid"
rules into their character equivalents (e.g., "%20" into the space
character).
The result is this XMPP address:
<jiři@čechy.example/v Praze>
2.9. Internationalization
Because XMPP addresses are [UTF-8] strings and because octets outside
the [US-ASCII] range within XMPP addresses can be easily converted to
percent-encoded octets, XMPP addresses are designed to work well with
Internationalized Resource Identifiers ([IRI]). In particular, with
the exceptions of stringprep verification, the conversion of
syntax-relevant [US-ASCII] characters (e.g., "?"), and the conversion
of percent-encoded octets from the "inodeid", "ihost", and "iresid"
rules into their character equivalents (e.g., "%20" into the
[US-ASCII] space character), an XMPP IRI can be constructed directly
by prepending the "xmpp" scheme and ":" character to an XMPP address.
Furthermore, an XMPP IRI can be converted into URI syntax by adhering
to the procedure specified in Section 3.1 of [IRI], and an XMPP URI
can be converted into IRI syntax by adhering to the procedure
specified in Section 3.2 of [IRI], thus ensuring interoperability
with applications that are able to process URIs but unable to process
IRIs.
3. IANA Registration of xmpp URI Scheme
In accordance with [URI-SCHEMES], this section provides the
information required to register the xmpp URI scheme.
3.1. URI Scheme Name
xmpp
3.2. Status
permanent
3.3. URI Scheme Syntax
The syntax for an xmpp URI is defined below using Augmented
Backus-Naur Form as specified by [ABNF], where the "fragment",
"host", "pct-encoded", and "unreserved" rules are defined in [URI]
and DQUOTE is defined in [ABNF]:
xmppuri = "xmpp" ":" hierxmpp [ "?" querycomp ] [ "#" fragment ]
hierxmpp = authpath / pathxmpp
authpath = "//" authxmpp [ "/" pathxmpp ]
authxmpp = nodeid "@" host
pathxmpp = [ nodeid "@" ] host [ "/" resid ]
nodeid = *( unreserved / pct-encoded / nodeallow )
nodeallow = "!" / "$" / "(" / ")" / "*" / "+" / "," / ";" /
"=" / "[" / "\" / "]" / "^" / "`" / "{" / "|" /
"}"
resid = *( unreserved / pct-encoded / resallow )
resallow = "!" / DQUOTE / "$" / "&" / "’" / "(" / ")" /
"*" / "+" / "," / ":" / ";" / "<" / "=" / ">" /
"[" / "\" / "]" / "^" / "`" / "{" / "|" / "}"
querycomp = querytype [ *pair ]
querytype = *( unreserved / pct-encoded )
pair = ";" key "=" value
key = *( unreserved / pct-encoded )
value = *( unreserved / pct-encoded )
3.4. URI Scheme Semantics
The xmpp URI scheme identifies entities that natively communicate
using the Extensible Messaging and Presence Protocol (XMPP), and is
mainly used for identification rather than for resource location.
However, if an application that processes an xmpp URI enables
interaction with the XMPP address identified by the URI, it MUST
follow the methodology defined in Section 2 of RFC 4622, Use of XMPP
IRIs and URIs, to reconstruct the encapsulated XMPP address, connect
to an appropriate XMPP server, and send an appropriate XMPP "stanza"
(XML fragment) to the XMPP address. (Note: There is no MIME type
associated with the xmpp URI scheme.)
3.5. Encoding Considerations
In addition to XMPP URIs, there will also be XMPP Internationalized
Resource Identifiers (IRIs). Prior to converting an Extensible
Messaging and Presence Protocol (XMPP) address into an IRI (and in
accordance with [XMPP-CORE]), the XMPP address must be represented as
[UTF-8] by the generating application (e.g., by transforming an
application’s internal representation of the address as a UTF-16
string into a UTF-8 string), and the UTF-8 string must then be
prepended with the "xmpp" scheme and ":" character. However, because
an XMPP URI must contain only [US-ASCII] characters, the UTF-8 string
of an XMPP IRI must be transformed into URI syntax by adhering to the
procedure specified in RFC 3987.
3.6. Applications/protocols That Use This URI Scheme Name
The xmpp URI scheme is intended to be used by interfaces to an XMPP
network from non-native user agents, such as web browsers, as well as
by non-native applications that need to identify XMPP entities as
full URIs or IRIs.
3.7. Interoperability Considerations
There are no known interoperability concerns related to use of the
xmpp URI scheme. In order to help ensure interoperability, the
Jabber Registrar function of the Jabber Software Foundation maintains
a registry of query types and keys that can be used in the query
components of XMPP URIs and IRIs, located at
<http://www.jabber.org/registrar/querytypes.html>.
3.8. Security Considerations
See Section 5 of RFC 4622, Security Considerations.
3.9. Contact
Peter Saint-Andre [mailto:stpeter@jabber.org,
xmpp:stpeter@jabber.org]
3.10. Author/Change Controller
This scheme is registered under the IETF tree. As such, the IETF
maintains change control.
3.11. References
[XMPP-CORE]
4. IANA Considerations
This document registers a URI scheme. The registration template can
be found in Section 3 of this document. In order to help ensure
interoperability, the Jabber Registrar function of the Jabber
Software Foundation maintains a registry of query types and keys that
can be used in the query components of XMPP URIs and IRIs, located at
<http://www.jabber.org/registrar/querytypes.html>.
5. Security Considerations
Providing an interface to XMPP services from non-native applications
introduces new security concerns. The security considerations
discussed in [IRI], [URI], and [XMPP-CORE] apply to XMPP IRIs, and
the security considerations discussed in [URI] and [XMPP-CORE] apply
to XMPP URIs. In accordance with Section 2.7 of [URI-SCHEMES] and
Section 7 of [URI], particular security considerations are specified
in the following sections.
5.1. Reliability and Consistency
Given that XMPP addresses of the form node@domain.tld are typically
created via registration at an XMPP server or provisioned by an
administrator of such a server, it is possible that such addresses
may also be unregistered or deprovisioned. Therefore, the XMPP
IRI/URI that identifies such an XMPP address may not be reliably and
consistently associated with the same principal, account owner,
application, or device.
XMPP addresses of the form node@domain.tld/resource are typically
even more ephemeral (since a given XMPP resource identifier is
typically associated with a particular, temporary session of an XMPP
client at an XMPP server); therefore the XMPP IRI/URI that identifies
such an XMPP address probably will not reliably and consistently be
associated with the same session. However, the procedures specified
in Section 10 of [XMPP-CORE] effectively eliminate any potential
confusion that might be introduced by the lack of reliability and
consistency for the XMPP IRI/URI that identifies such an XMPP
address.
XMPP addresses of the form domain.tld are typically long-lived XMPP
servers or associated services; although naturally it is possible for
server or service administrators to de-commission the server or
service at any time, typically the IRIs/URIs that identify such
servers or services are the most reliable and consistent of XMPP
IRIs/URIs.
XMPP addresses of the form domain.tld/resource are not yet common on
XMPP networks; however, the reliability and consistency of XMPP
IRIs/URIs that identify such XMPP addresses would likely fall
somewhere between those that identify XMPP addresses of the form
domain.tld and those that identify XMPP addresses of the form
node@domain.tld.
5.2. Malicious Construction
Malicious construction of XMPP IRIs/URIs is made less likely by the
prohibition on port numbers in XMPP IRIs/URIs (since port numbers are
to be discovered using [DNS-SRV] records, as specified in
[XMPP-CORE]).
5.3. Back-End Transcoding
Because the base XMPP protocol is designed to implement the exchange
of messages and presence information and not the retrieval of files
or invocation of similar system functions, it is deemed unlikely that
the use of XMPP IRIs/URIs would result in harmful dereferencing.
However, if an XMPP protocol extension defines methods for
information retrieval, it MUST define appropriate controls over
access to that information. In addition, XMPP servers SHOULD NOT
natively parse XMPP IRIs/URIs but instead SHOULD accept only the XML
wire protocol specified in [XMPP-CORE] and any desired extensions
thereto.
5.4. Sensitive Information
The ability to interact with XMPP entities via a web browser or other
non-native application may expose sensitive information (such as
support for particular XMPP application protocol extensions) and
thereby make it possible to launch attacks that are not possible or
that are unlikely on a native XMPP network. Due care must be taken
in deciding what information is appropriate for representation in
XMPP IRIs or URIs.
In particular, advertising XMPP IRIs/URIs in publicly accessible
locations (e.g., on websites) may make it easier for malicious users
to harvest XMPP addresses from the authority and path components of
XMPP IRIs/URIs and therefore to send unsolicited bulk communications
to the users or applications represented by those addresses. Due
care should be taken in balancing the benefits of open information
exchange against the potential costs of unwanted communications.
To help prevent leaking of sensitive information, passwords and other
user credentials are forbidden in the authority component of XMPP
IRIs/URIs; in fact they are not needed, since the fact that
authentication in XMPP occurs via [SASL] makes it possible to use the
SASL ANONYMOUS mechanism, if desired.
5.5. Semantic Attacks
Despite the existence of non-hierarchical URI schemes such as
[MAILTO], by association human users may expect all URIs to include
the "//" characters after the scheme name and ":" character.
However, in XMPP IRIs/URIs, the "//" characters precede the authority
component rather than the path component. Thus,
xmpp://guest@example.com indicates to authenticate as
"guest@example.com", whereas xmpp:guest@example.com identifies the
node "guest@example.com". Processing applications MUST clearly
differentiate between these forms, and user agents SHOULD discourage
human users from including the "//" characters in XMPP IRIs/URIs
since use of the authority component is envisioned to be helpful only
in specialized scenarios, not more generally.
5.6. Spoofing
The ability to include effectively the full range of Unicode
characters in an XMPP IRI may make it easier to execute certain forms
of address mimicking (also called "spoofing"). However, XMPP IRIs
are no different from other IRIs in this regard, and applications
that will present XMPP IRIs to human users must adhere to best
practices regarding address mimicking in order to help prevent
attacks that result from spoofed addresses (e.g., the phenomenon
known as "phishing"). For details, refer to the Security
Considerations of [IRI].
6. References
6.1. Normative References
[ABNF] Crocker, D. and P. Overell, "Augmented BNF for Syntax
Specifications: ABNF", RFC 4234, October 2005.
[IRI] Duerst, M. and M. Suignard, "Internationalized
Resource Identifiers (IRIs)", RFC 3987, January 2005.
[TERMS] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[URI] Berners-Lee, T., Fielding, R., and L. Masinter,
"Uniform Resource Identifier (URI): Generic Syntax",
STD 66, RFC 3986, January 2005.
[XMPP-CORE] Saint-Andre, P., "Extensible Messaging and Presence
Protocol (XMPP): Core", RFC 3920, October 2004.
6.2. Informative References
[CPIM] Peterson, J., "Common Profile for Instant Messaging
(CPIM)", RFC 3860, August 2004.
[CPP] Peterson, J., "Common Profile for Presence (CPP)",
RFC 3859, August 2004.
[DNS-SRV] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR
for specifying the location of services (DNS SRV)",
RFC 2782, February 2000.
[HTML] Raggett, D., "HTML 4.0 Specification", W3C
REC REC-html40-19980424, April 1998.
[HTTP-AUTH] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence,
S., Leach, P., Luotonen, A., and L. Stewart, "HTTP
Authentication: Basic and Digest Access
Authentication", RFC 2617, June 1999.
[IDNA] Faltstrom, P., Hoffman, P., and A. Costello,
"Internationalizing Domain Names in Applications
(IDNA)", RFC 3490, March 2003.
[JEP-0009] Adams, D., "Jabber-RPC", JSF JEP 0009, February 2006.
[JEP-0030] Hildebrand, J., Millard, P., Eatmon, R., and P.
Saint-Andre, "Service Discovery", JSF JEP 0030,
January 2006.
[JEP-0045] Saint-Andre, P., "Multi-User Chat", JSF JEP 0045,
September 2005.
[JEP-0053] Saint-Andre, P., "Jabber Registrar", JSF JEP 0053,
May 2004.
[JEP-0060] Millard, P., Saint-Andre, P., and R. Meijer,
"Publish-Subscribe", JSF JEP 0060, June 2005.
[JEP-0072] Forno, F. and P. Saint-Andre, "SOAP Over XMPP", JSF
JEP 0072, December 2005.
[JEP-0077] Saint-Andre, P., "In-Band Registration", JSF JEP 0077,
January 2006.
[JEP-0147] Saint-Andre, P., "XMPP IRI/URI Query Components", JSF
JEP 0147, March 2006.
[MAILTO] Hoffman, P., Masinter, L., and J. Zawinski, "The
mailto URL scheme", RFC 2368, July 1998.
[MIME] Freed, N. and N. Borenstein, "Multipurpose Internet
Mail Extensions (MIME) Part Two: Media Types",
RFC 2046, November 1996.
[SASL] Melnikov, A. and K. Zeilenga, "Simple Authentication
and Security Layer (SASL)", RFC 4422, June 2006.
[STRINGPREP] Hoffman, P. and M. Blanchet, "Preparation of
Internationalized Strings ("STRINGPREP")", RFC 3454,
December 2002.
[UNICODE] The Unicode Consortium, "The Unicode Standard, Version
3.2.0", 2000.
The Unicode Standard, Version 3.2.0 is defined by The
Unicode Standard, Version 3.0 (Reading, MA, Addison-
Wesley, 2000. ISBN 0-201-61633-5), as amended by the
Unicode Standard Annex #27: Unicode 3.1
(http://www.unicode.org/reports/tr27/) and by the
Unicode Standard Annex #28: Unicode 3.2
(http://www.unicode.org/reports/tr28/).
[URI-SCHEMES] Hansen, T., Hardie, T., and L. Masinter, "Guidelines
and Registration Procedures for New URI Schemes",
RFC 4395, February 2006.
[US-ASCII] American National Standards Institute, "Coded
Character Set - 7-bit American Standard Code for
Information Interchange", ANSI X3.4, 1986.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO
10646", STD 63, RFC 3629, November 2003.
[XMPP-IM] Saint-Andre, P., "Extensible Messaging and Presence
Protocol (XMPP): Instant Messaging and Presence",
RFC 3921, October 2004.
Author’s Address
Peter Saint-Andre
Jabber Software Foundation
EMail: stpeter@jabber.org
URI: xmpp:stpeter@jabber.org
Full Copyright Statement
Copyright (C) The Internet Society (2006).
This document is subject to the rights, licenses and restrictions
contained in BCP 78, and except as set forth therein, the authors
retain all their rights.
This document and the information contained herein are provided on an
"AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS
OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND THE INTERNET
ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED,
INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE
INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED
WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
Intellectual Property
The IETF takes no position regarding the validity or scope of any
Intellectual Property Rights or other rights that might be claimed to
pertain to the implementation or use of the technology described in
this document or the extent to which any license under such rights
might or might not be available; nor does it represent that it has
made any independent effort to identify any such rights. Information
on the procedures with respect to rights in RFC documents can be
found in BCP 78 and BCP 79.
Copies of IPR disclosures made to the IETF Secretariat and any
assurances of licenses to be made available, or the result of an
attempt made to obtain a general license or permission for the use of
such proprietary rights by implementers or users of this
specification can be obtained from the IETF on-line IPR repository at
http://www.ietf.org/ipr.
The IETF invites any interested party to bring to its attention any
copyrights, patents or patent applications, or other proprietary
rights that may cover technology that may be required to implement
this standard. Please address the information to the IETF at
ietf-ipr@ietf.org.
Acknowledgement
Funding for the RFC Editor function is provided by the IETF
Administrative Support Activity (IASA).