[jdev] Re: XHTML-IM XEP implementation

JD Conley jd.conley at coversant.net
Thu Jan 4 16:25:12 CST 2007

> Justin Karneges wrote:
> > This begs the question: what is too big?  Currently, we consider
> stanza size
> > to be somewhat unbounded, as XMPP-Core imposes no size maximum.  But
> I
> > believe we do need some mechanism for a stanza maximum size,
> otherwise XMPP
> > software is prone to denial-of-service attacks.

> agreed
> but the max stanza size depends mostly on the server configuration. We
> can recommend a number in the RFC and make a note about possible DNS
> attacks and memory overflows if a server allows a unlimited stanza
> and XML depth. I think a client should be able to retrieve the max
> stanza size using disco and cache it.

I also agree. Our server's default max stanza size (configurable) is
currently 1MB. Any other implementers care to chime in? :) We need some
sort of protocol so clients know limits such as this, stanza rate
limiting, etc (probably just a disco form). 


More information about the JDev mailing list