26 Sep
2024
26 Sep
'24
9:07 a.m.
Hi,
"XEP-0484: Fast Authentication Streamlining Tokens" is written without any
considerations for multiple devices.
With stuff like that "*For every client using FAST, have two token slots -
'current' and 'new'." *in it.
I am kinda confused how the XEP could be considered in 2024. The moment we
have two devices for the same user, the devices would start conflicting
with each other, by revoking tokens of each other.
The XEP should use namespaces (or be resource aware) for it to properly
work.
--
Best regards,
Uvarov Michael
26 Sep
26 Sep
10:07 a.m.
On Thu, 26 Sept 2024 at 16:09, Michael Uvarov <freeakk(a)gmail.com> wrote:
With stuff like that "*For every client using
FAST, have two token slots
- 'current' and 'new'." *in it.
I am kinda confused how the XEP could be considered in 2024. The moment we
have two devices for the same user, the devices would start conflicting
with each other, by revoking tokens of each other.
No, it's using the id of the user-agent in SASL2 to disambiguate, and it
has a pair of slots (current and new) for each client (by user-agent/id,
presumably).
Do you have a suggestion for how to make this clearer?
Dave.
11:14 a.m.
Oh, user-agent id to distinguish between devices of the same bare JID
sounds amazing, thank you for the hint.
Maybe mentioning it in the XEP-0484 would be helpful for people
implementing this on the server side.
On Thu, 26 Sept 2024 at 18:08, Dave Cridland <dave(a)cridland.net> wrote:
On Thu, 26 Sept 2024 at 16:09, Michael Uvarov <freeakk(a)gmail.com> wrote:
--
С уважением,
Уваров Михаил.
Best regards,
Uvarov Michael
With stuff like that "*For every client
using FAST, have two token slots
- 'current' and 'new'." *in it.
I am kinda confused how the XEP could be considered in 2024. The moment
we have two devices for the same user, the devices would start conflicting
with each other, by revoking tokens of each other.
No, it's using the id of the user-agent in SASL2 to disambiguate, and it
has a pair of slots (current and new) for each client (by user-agent/id,
presumably).
Do you have a suggestion for how to make this clearer?
Dave.
_______________________________________________
Standards mailing list -- standards(a)xmpp.org
To unsubscribe send an email to standards-leave(a)xmpp.org
29 Sep
29 Sep
1:44 p.m.
On Thu, 26 Sept 2024 at 18:15, Michael Uvarov <freeakk(a)gmail.com> wrote:
Oh, user-agent id to distinguish between devices of
the same bare JID
sounds amazing, thank you for the hint.
Maybe mentioning it in the XEP-0484 would be helpful for people
implementing this on the server side.
It's mentioned in Section 4.1: XEP-0484: Fast Authentication Streamlining
Tokens (xmpp.org) <https://xmpp.org/extensions/xep-0484.html#rules-clients> -
I'm sure that Matt would welcome any suggestions you have to make it
clearer though?
Dave.
111
days inactive
114
days old
3 comments
2 participants
participants (2)
-
Dave Cridland -
Michael Uvarov