Re: See-other-uri and insecure web sockets

On Mar 4, 2014, at 4:44 PM, Kevin Smith <[email protected]> wrote:

>> I think this is a bad idea -- I don't see any reason why see-other-uri should be any less trusted than anything else received over an insecure connection.  And indeed, I think that most servers (if they have a ws listener at all) would want to respond to insecure XMPP connections by sending a see-other-uri pointing at their wss uri!
> 
> I think this scenario is somewhat unlikely - in this case the
> discovery would have pointed to was (either hard-coded or over 156 or
> whatever).

Well, you need to do *something* if someone tries to connect to <ws://websocketserver.example/xmpp-bind>, but I guess responding with 301 or 404 to the HTTP handshake, prior to protocol handover, would be better than switching to xmpp and then using see-other-uri.