Re: See-other-uri and insecure web sockets
Peter Saint-Andre <[email protected]>
| Newsgroups | gmane.ietf.xmpp |
|---|---|
| Message-ID | <[email protected]> |
On 3/4/14, 6:02 PM, Jonathan Lennox wrote: > > On Mar 4, 2014, at 4:44 PM, Kevin Smith <[email protected]> wrote: > >>> I think this is a bad idea -- I don't see any reason why see-other-uri should be any less trusted than anything else received over an insecure connection. And indeed, I think that most servers (if they have a ws listener at all) would want to respond to insecure XMPP connections by sending a see-other-uri pointing at their wss uri! >> >> I think this scenario is somewhat unlikely - in this case the >> discovery would have pointed to was (either hard-coded or over 156 or >> whatever). > > Well, you need to do *something* if someone tries to connect to <ws://websocketserver.example/xmpp-bind>, but I guess responding with 301 or 404 to the HTTP handshake, prior to protocol handover, would be better than switching to xmpp and then using see-other-uri. Yes, I think that's the better approach - the earlier the better. Peter