Re: See-other-uri and insecure web sockets
Peter Saint-Andre <[email protected]>
| Newsgroups | gmane.ietf.xmpp |
|---|---|
| Message-ID | <[email protected]> |
On 3/5/14, 9:29 AM, Ben Campbell wrote: > > On Mar 5, 2014, at 1:42 AM, Peter Saint-Andre <[email protected]> wrote: > >>> >>> Well, you need to do *something* if someone tries to connect to <ws://websocketserver.example/xmpp-bind>, but I guess responding with 301 or 404 to the HTTP handshake, prior to protocol handover, would be better than switching to xmpp and then using see-other-uri. >> >> Yes, I think that's the better approach - the earlier the better. > > Does that mean we don't need see-other-uri at all? No, it means that if the client tries to go to an http or ws URI, it is best for the service to redirect to an https or wss URI using standard HTTP methods, not XMPP methods. We still need the see-other-uri for more advanced scenarios in the XMPP context - typically, telling the client about an alternative or fallback WebSocket endpoint, just like see-other-host from RFC 6120 but for WebSocket endpoints instead of TCP endpoints. Peter