I agree that XEP-0363 should add a deletion feature. However, as you pointed out, a file might be uploaded from one device and deleted from another, even when both devices are using the same account. XEP-0363 has no sharing mechanism, so a desktop client might not know what a mobile client has uploaded at all; it would have to rely on sources such as avatars or MAM chat archives. In that case, it does seem better to use XEP-0498 directly. Matthew Wild <mwild1@gmail.com> On Mon, 9 Nov 2026 at 20:00 ：
On Mon, 9 Nov 2026 at 12:00, yiwei wu <huxiangkun2003@gmail.com> wrote:
The upload service MUST verify that the requester is authorized to delete the file before deleting it. For example, a service can record the bare JID that requested each slot and permit deletion by that bare JID, irrespective of the resource used for the deletion request.
Would it make sense to reuse the Authorization and Cookie headers from the upload request to authenticate the deletion request?
Yes, it was a tempting design to rely on secret information from the initial slot request/response.
Unfortunately the client which uploaded the file may not be the same client which deletes the file. The secret information (PUT URL, headers, etc.) is not stored or shared by the uploading client, so is no longer available. The download URL is the main stable identifier we have, and allows e.g. admin deletions as well.
Regards, Matthew _______________________________________________ Standards mailing list -- standards@xmpp.org To unsubscribe send an email to standards-leave@xmpp.org