30.04.2008

JabberIDs as URI

posted by Karsten

Not sure if this potentially is an issue:

JabberIDs are case in-sensitive, whereas URIs are case sensitive!

I tried a testcase where a user was called systemUser (guess what he had rights to do? 😉 ), and when using that URI in couldn’t authenticate. It has taken me at least 45 minutes to find the when calling XMPPconnection.getUser() in the smack library the username is converted to lowercase. I use this method to add the user to the list of users with system rights, so when authenticating the JabberID systemUser, then this wasn’t on the list!!

It is obviously easy to hack this problem by checking lowercase versions of IDs,, but this is an awful hack, which might break, unless we specify that MeaUserID == jabberID and must be unique in lowercase versions.

Is this a fair assumption? I don’t know…

(EDIT: I’ve added this to the issues list at www.meaggregator.org)

Share

6 Responses to “JabberIDs as URI”

  1. Karsten Oster Lundqvist says:

    Just realised that it probably isn't that bad, as URLs also are case insensitive…

  2. P@ Parslow says:

    Are URLs case insensitive by definition?  I know in practice that the path part is case sensitive if the underlying OS supports case sensitivity (I believe the host and scheme parts are insensitive by definition)

  3. P@ Parslow says:

    Yes, and indeed it is in an RFC somewhere, but that takes effort to find, and so often someone clever likes to point out which RFC it is in, and the history of the decision, and their shoe size… but alas, on this occasion nobody was being sufficiently geeky Wink

    Thanks for helping me confirm I am not going mad though!

  4. Karsten Oster Lundqvist says:

    Thus – emails and jabberID's might be case insensitive, and therefore I've implemented that in the MeAggregated.

  5. Arun says:

    HTTP RFC 2616

  6. Karsten Oster Lundqvist says:

    Just to clarify:

    I kinda know the rfc2616, unfortunately it states that:

    When comparing two URIs to decide if they match or not, a client SHOULD use a case-sensitive octet-by-octet comparison of the entire URIs, with these exceptions: bla bla bla

    So, URIs are case sensitive, unfortunately this is not always being implemented nor observed by servers…

Place your comment

Please fill your data and comment below.
Name
Email
Website
Your comment