Re: [xmpp] 'to' attribute on stanzas from server->client

[Peter Saint-Andre <[e-mail]>]

On 10/16/10 6:18 AM, Florian Zeitz wrote:
> Am 16.10.2010 06:00, schrieb Peter Saint-Andre:
>> On 10/15/10 3:13 PM, Florian Zeitz wrote:
>>
>>>>> E.g. I have previously mentioned the social network that tells a client
>>>>> one JID during resource binding, but uses a completely different one for
>>>>> everything else. If clients were to ignore the 'to' attribute this would
>>>>> be valid (well doable) behavior and I personally think that's quite bad.
>>>>> Also almost all clients utterly fail against that service (at least for
>>>>> the roster get, not sure if we have text that causes this), so that
>>>>> change wouldn't be documenting the "status quo".
>>>>> It's probably sensible to define that stanzas that have a 'to' attribute
>>>>> where the bare portion of the JID matches MUST be handled.
>>>>
>>>> That seems reasonable, although I'm trying to come up with exceptions
>>>> and counter-examples so I think SHOULD might be enough.
>>>>
>>> That would be fine with me.
>>
>> We don't have any text right now in 3920bis about client handling of
>> incoming stanzas. Currently we assume that the client trusts the server
>> to not deliver stanzas that are intended for another account. This
>> client checking of the 'to' address seems like a faux security measure
>> to me ("protecting" the client against stanzas that were originally
>> addressed a different authorized resource of the same account). Do we
>> really need to add some text saying "there's no need for the client to
>> check the 'to' address of stanzas it receives from the server"? I mean,
>> if your server is sending you malicious stanzas of some kind (which it
>> could easily do by rewriting every 'to' address anyway!), then you have
>> much bigger problems.
>>
> My concern was actually different. A client developer could guess that
> it's "okay" to check the 'to' address (for whatever reason). After
> having slept over it I'm actually convinced that it is in fact safe to
> ignore this. However that you *have to* ignore it (or at least not check
> against the full JID) is not entirely clear IMHO.
> The text proposed in the other branch of this thread addresses this to
> some extent (albeit implicitly).
> However if people are writing bug reports against servers about this it
> might be worth a Implemenation Note.

Look, it's fine for someone to write a paranoid client. I happen to
think it's stupid to do so, because if you don't trust your server at
such a fundamental level then you have bigger problems, but I don't
think we can say that a client MUST NOT try to check the 'to' address of
incoming stanzas. However, I think we could say something like this:

   Implementation Note: Because it is the server's responsibility to
   deliver only stanzas that were addressed to the client's full JID or
   the user's bare JID, there is no need for the client to check the
   'to' address of incoming stanzas.

/psa