jdev - 2020-10-24

should a client check the jid on a iq response

i use a uuid as iq id

and i dont check if the jid in the response is the jid i did send the iq to ✏

because i always thought its almost impossible that another account can send me a response with this id that fits what i expect

I think we pondered about that in the past and tried to come up with situations where you leak the id of an in-flight IQ to third parties. But I'm not sure what the outcome was

Why wouldn't you check the JID?

because its additional work

still it's good practice to check the sender JID

there should be a gain which we could name

but i just realized its very easy to do this

right now i have the callbacks in a dict

id: callbacks

and i just need to save it like (jid, id): callback

don't forget to expire them from the map after a timeout