Re: [xmpp] 'to' attribute on stanzas from server->client

[Paul Aurich <[e-mail]>]

On 2010-10-15 13:41, Florian Zeitz wrote:
> E.g. I have previously mentioned the social network that tells a client
> one JID during resource binding, but uses a completely different one for
> everything else. If clients were to ignore the 'to' attribute this would
> be valid (well doable) behavior and I personally think that's quite bad.
> Also almost all clients utterly fail against that service (at least for
> the roster get, not sure if we have text that causes this), so that
> change wouldn't be documenting the "status quo".

For what it's worth, my recollection of the issue with the social
network-that-we're-not-naming-and-shaming was that they stamped their IQ
response with a "from" attribute of what *they* thought the bare JID of
the account was (which wasn't what they told the client it was during
session binding), and clients validate that someone sending them roster
stanzas is allowed to do so (i.e. is from the account's bare JID or the
full JID of this session, the later option due to a quirk in RFC3921, IIRC).

At least, that was the primary issue with Pidgin (I can't think of any
specific places we validate the "to" attribute).

~Paul