XSF Discussion - 2022-06-28

How are people typically sharing 363 URLs - SIMS(385)?

XEP-0066, OOB. ✏

OOB is iq-only, and doesn't include useful information like file size, does it?

Maybe I should go check.

it is not iq-only

Ah, fab.

see https://xmpp.org/extensions/xep-0066.html#x-oob

it does not include useful information like file size, but it works and is widely deployed, which is all what counts I suppose

Still misses all the contenttype/size etc. info though :/

(note the sarcasm)

Yeah, I specifically need filesize to be communicated.

please push SIMS forward.

or XEP-0447 ?

How are people managing fallback with OOB?

Kev: let me tell you about HTTP HEAD

Kev, fallback?

Kev: some implementations require the oob url to be equal to the message body, others require it to be contained within the body

OOB is only accepted by deployed clients if body == OOB-URL, otherwise it's ignored.

Ge0rG: I want to be avoiding any HTTP requests at all if the file is too large to download at the moment. I'm not thinking about Internet use, predictably.

ah, so subset is ok too, apparently.

jonas’: implementation-defined

I'm not aware of anyone using iq-0066

Kev: understandably

Ok, ta.

Kev, just watch out, it's not like you can trust the size https://www.moparisthebest.com/httppppppppppp-upload/

I'm thinking about slightly special cases :)

(Although it's true the code should also work on the hostile Internet)

has anyone seen HTTP File Upload components require the use of Cookie headers?

No but Prosody uses the Authorization header, which triggered implementation of header support in some clients that were missing it.

The question about Cookies is particularly interesting, because Browsers might be Not Happy about setting cookies for particular cross-site requests. ✏

Whereas the auth header shouldn't pose any great problem.

I seem to remember the Auth header being special wrt CORS and in certain APIs

Yes, those rules already apply to Authorization as well as Cookie

and in general, not a problem as long as the service supports CORS correctly (i.e. allowing With-Credentials)

Authorization's just a case of having the CORS headers, AFAICS. I've been told today by webbish folks that cookies are much harder.

According to https://xhr.spec.whatwg.org/#the-setrequestheader()-method you can't set Cookie as it's a forbidden name

or do you have to go via withCredentials then?

withCredentials doesn't allow you to inject cookies, AFAIK. ✏