search

nioc / xmpp-web

Lightweight web chat client for XMPP server
GNU Affero General Public License v3.0
143 stars 20 forks source link

Opening several tabs (randomize resource) #93

Closed nioc closed 1 year ago

nioc commented 1 year ago

Intended behavior

When I develop the application, I would like to have two instances for the same user.

Solution

Randomize the resource in dev mode.

Alternatives

No response

Priority

Could-have

Users scope

registered users

Affected features

login

Pull request

yes

Ppjet6 commented 1 year ago

May I suggest that you do this all the time?

Nowadays most clients have something of the form 'client name.random bits' set as a resource. Reusing the same resource isn't something recommended anymore (I would need to ask someone for the reasoning behind).

nioc commented 1 year ago

I'm glad you asked, I opened this issue for this very reason 😎 I did not know what the recommendations are for the resource.

nioc commented 1 year ago

By the way, are there any rules or constraints to respect regarding the format of the resource (forbidden characters or other things)? I did not find anything even on the §3.4

Ppjet6 commented 1 year ago

Wait! You are too fast! ^^'

I went to confirm on the XSF channel and I was off, here is what I got:

best practice is to use a randomized (or server assigned) resource, but then re-use that resource for subsequent reconnects, as it, for example, improves the chances that you get stanzas that where addressed to this resource prior the reconnect

one could argue that a malicious actor may learn your resource, so you may still want to rotate it once in a while

And

If someone knows (or can guess) your resource then they can tell when you are online, which is considered a presence leak and something we have always tried to protect against

So basically you still want to do this, generate a random resource, except you want to store the it and reuse it all the time.

Also, "obviously", this doesn't apply for sasl anon, as it's not possible to reuse the same session anyway.

Ppjet6 commented 1 year ago

As for constraints on the resource, there's an updated spec here: https://www.rfc-editor.org/rfc/rfc6122#section-2.4. And in general the 3920 RFC series is obsolete and 6120 is to be used :)

nioc commented 1 year ago

No problem, if needed, I will reopen it or create a new one.

I'm not sure what is the best, but I suggest we can initialize random string at register tab creation and then store in memory (not local storage since it would be reused across other tabs) and reuse it for this specific tab (it would apply only for logout / reconnect). Am I right?

Ppjet6 commented 1 year ago

Yeah that sounds alright to me!