RFC 5122

Internationalized Resource Identifiers (IRIs) and Uniform Resource Identifiers (URIs) for the Extensible Messaging and Presence Protocol (XMPP)

📅 published February 2008, from ietf

RFC 5122 📚✨

Internationalized Resource Identifiers (IRIs) and Uniform Resource Identifiers (URIs) for the Extensible Messaging and Presence Protocol (XMPP) 🎀

Network Working Group 🌐
Request for Comments: 5122
Author: P. Saint-Andre, XSF 💜
Date: February 2008 🍓
Category: Standards Track 👑
Obsoletes: RFC 4622 (so this one replaces it 💅)

Status of This Memo 🧾

okay bestie, this is an Internet standards track protocol spec meant for the whole Internet community 🌍, and the authors are literally asking for discussion and suggestions for improvements 🫶. If you want the official standardization state and status of this protocol, go check the current edition of "Internet Official Protocol Standards" (STD 1) 📜. And the distribution of this memo is unlimited 🦋.

Abstract 🦋

this doc defines how IRIs and URIs get used when you're identifying or interacting with entities that can talk over XMPP ✨. It also obsoletes RFC 4622, so yeah, this is the new main character 👑.

Table of Contents 🗺️

1.  Introduction . . . . . . . . . . . . . . . . . . . . . . . . .  3
  1.1.  Terminology  . . . . . . . . . . . . . . . . . . . . . . .  3
2.  Use of XMPP IRIs and URIs  . . . . . . . . . . . . . . . . . .  4
  2.1.  Rationale  . . . . . . . . . . . . . . . . . . . . . . . .  4
  2.2.  Form . . . . . . . . . . . . . . . . . . . . . . . . . . .  5
  2.3.  Authority Component  . . . . . . . . . . . . . . . . . . .  6
  2.4.  Path Component . . . . . . . . . . . . . . . . . . . . . .  7
  2.5.  Query Component  . . . . . . . . . . . . . . . . . . . . .  8
  2.6.  Fragment Identifier Component  . . . . . . . . . . . . . .  9
  2.7.  Generation of XMPP IRIs/URIs . . . . . . . . . . . . . . . 10
  2.8.  Processing of XMPP IRIs/URIs . . . . . . . . . . . . . . . 13
  2.9.  Internationalization . . . . . . . . . . . . . . . . . . . 16
3.  IANA Registration of xmpp URI Scheme . . . . . . . . . . . . . 16
  3.1.  URI Scheme Name  . . . . . . . . . . . . . . . . . . . . . 16
  3.2.  Status . . . . . . . . . . . . . . . . . . . . . . . . . . 16
  3.3.  URI Scheme Syntax  . . . . . . . . . . . . . . . . . . . . 17
  3.4.  URI Scheme Semantics . . . . . . . . . . . . . . . . . . . 17
  3.5.  Encoding Considerations  . . . . . . . . . . . . . . . . . 17
  3.6.  Applications/Protocols That Use This URI Scheme Name . . . 18
  3.7.  Interoperability Considerations  . . . . . . . . . . . . . 18
  3.8.  Security Considerations  . . . . . . . . . . . . . . . . . 18
  3.9.  Contact  . . . . . . . . . . . . . . . . . . . . . . . . . 18
  3.10. Author/Change Controller . . . . . . . . . . . . . . . . . 18
  3.11. References . . . . . . . . . . . . . . . . . . . . . . . . 18
4.  IANA Considerations  . . . . . . . . . . . . . . . . . . . . . 18
5.  Security Considerations  . . . . . . . . . . . . . . . . . . . 19
  5.1.  Reliability and Consistency  . . . . . . . . . . . . . . . 19
  5.2.  Malicious Construction . . . . . . . . . . . . . . . . . . 20
  5.3.  Back-End Transcoding . . . . . . . . . . . . . . . . . . . 20
  5.4.  Sensitive Information  . . . . . . . . . . . . . . . . . . 20
  5.5.  Semantic Attacks . . . . . . . . . . . . . . . . . . . . . 21
  5.6.  Spoofing . . . . . . . . . . . . . . . . . . . . . . . . . 21
6.  Acknowledgements . . . . . . . . . . . . . . . . . . . . . . . 21
7.  References . . . . . . . . . . . . . . . . . . . . . . . . . . 21
  7.1.  Normative References . . . . . . . . . . . . . . . . . . . 21
  7.2.  Informative References . . . . . . . . . . . . . . . . . . 22
Appendix A.  Differences from RFC 4622 . . . . . . . . . . . . . . 25
Appendix B.  Copying Conditions  . . . . . . . . . . . . . . . . . 25

1. Introduction 🌸

okay so XMPP is a streaming XML technology 💫. It lets any two entities on a network swap well-defined but extensible XML elements (called "XML stanzas") at a rate that's close to real time ⚡.

As [XMPP-CORE] specifies, entity addresses used in XMPP communications must not be prepended with a Uniform Resource Identifier (URI) scheme (as specified in [URI]) 🙅‍♀️. BUT external apps might still need to identify XMPP entities as URIs or, in a more modern way, as Internationalized Resource Identifiers (IRIs; see [IRI]) 🧚. Think databases that have to store XMPP addresses, and non-native user agents like web browsers and calendaring apps that give you interfaces to XMPP services 💻.

The format for an XMPP address is defined in [XMPP-CORE]. An address can hold almost any Unicode character [UNICODE] and has to fit various profiles of stringprep [STRINGPREP] 🔤. So the result is that an XMPP address is fully internationalizable and is basically an IRI without a scheme 🌈. Here's the catch though: there's no freestanding registry of IRI schemes, so XMPP identifiers have to be defined mainly as URIs instead of IRIs, and we register an XMPP URI scheme rather than an IRI scheme 🥺. So this document does the following:

Specifies how to identify XMPP entities as IRIs or URIs.
Specifies how to interact with XMPP entities as IRIs or URIs.
Formally defines the syntax for XMPP IRIs and URIs.
Specifies how to transform XMPP IRIs into URIs and vice versa.
Registers the xmpp URI scheme.

1.1. Terminology 🏷️

this doc inherits its terminology from [IRI], [URI], and [XMPP-CORE] 📖.

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in RFC 2119 [TERMS] 🔑.

2. Use of XMPP IRIs and URIs 🎀

2.1. Rationale 💭

as described in [XMPP-IM], instant messaging and presence apps built on XMPP have to handle im: and pres: URIs (as specified by [CPIM] and [CPP]) 💬. But there are tons of other XMPP apps too (think network management, workflow systems, generic publish-subscribe, remote procedure calls, content syndication, gaming, and middleware) 🎮, and those don't do instant messaging or presence semantics at all 🙃. On top of that, a generic XMPP entity doesn't implement the semantics of any existing URI scheme, like the http:, ftp:, or mailto: scheme 😭. So it makes sense to define a brand-new URI scheme that lets you identify or interact with any XMPP entity (not just the IM and presence ones) as an IRI or URI 🦋.

XMPP IRIs and URIs are for non-native interfaces and apps 🪄. Now, to keep things interoperable on XMPP networks, when data gets routed to an XMPP entity (for example, when an XMPP address is in the 'to' or 'from' attribute of an XML stanza), or when an XMPP entity is otherwise identified in standard XMPP protocol elements, the entity MUST be addressed as <[node@]domain[/resource]> (so, no prepended scheme!) 🚫. The "node identifier", "domain identifier", and "resource identifier" parts of an XMPP address have to conform to the definitions in Section 3 of [XMPP-CORE] 📐.

Note: In XMPP, "resource identifier" is a historical term for the optional bit of an XMPP address that comes after the domain identifier and the "/" separator character (see Section 3.4 of [XMPP-CORE] for details). Don't mix this up with the meanings of "resource" and "identifier" from Section 1.1 of [URI] 🙈.

XMPP IRIs and URIs are defined primarily for identification rather than interaction (for more on that distinction, see Section 1.2.2 of [URI]) 🔍. The "Internet resource" that an XMPP IRI or URI identifies is an entity that can communicate via XMPP over a network 🛰️. An XMPP IRI or URI can carry extra info beyond the identified resource itself. In particular, as described under Section 2.5, a query component can be included to suggest semantics for an interaction with the identified resource 💌. The idea is that when an XMPP app resolves an XMPP IRI or URI with suggested interaction semantics, it'll generate an XMPP stanza and send it to the identified resource 📨. That generated stanza may include user or application inputs that match the suggested interaction semantics (for details, see Section 2.8.1) ✨.

2.2. Form ✨

okay so, as [XMPP-CORE] explains, an XMPP address that's used natively on an XMPP network is a string of Unicode characters that (1) conforms to a certain set of stringprep [STRINGPREP] profiles and IDNA restrictions [IDNA], (2) follows a certain set of syntax rules, and (3) is encoded as UTF-8 [UTF-8] 💅 the form can be written in Augmented Backus-Naur Form [ABNF] like this:

      [ node "@" ] domain [ "/" resource ]

the "node" and "resource" rules rely on different stringprep profiles, and the "domain" rule relies on the idea of an internationalized domain name as described in [IDNA] 🌸 (Note: there's no need to bring up punycode in the IRI syntax itself, since any punycode representation would only show up inside an XMPP application to represent internationalized domain names. However, it is the responsibility of the processing application to convert IRI syntax [IRI] into IDNA syntax [IDNA] before addressing XML stanzas to the specified entity on an XMPP network.)

certain characters are allowed in XMPP node identifiers and XMPP resource identifiers, but NOT in the matching part of an IRI or URI 🙈 here they are:

In node identifiers:  [ \ ] ^ ` { | }

In resource identifiers:  " < > [ \ ] ^ ` { | }

the node identifier characters aren't allowed in userinfo because of the sub-delims rule, and the resource identifier characters aren't allowed in segment because of the pchar rule. these characters MUST be percent-encoded when transforming an XMPP address into an XMPP IRI or URI. no exceptions, bestie 💖

and obviously, to turn an XMPP address into an IRI or URI, you have to slap the xmpp scheme on the front (sooo iconic). it may also need some transformations that follow the rules in [IRI] and [URI] 🦋 plus, if you want more advanced interaction with an XMPP entity instead of just identifying it, it's giving to use the extra URI stuff too: authority components, query components, and fragment identifier components 👑

so the ABNF syntax for an XMPP IRI is defined below using Augmented Backus-Naur Form from [ABNF]. the "ifragment", "ihost", and "iunreserved" rules are defined in [IRI], and the "pct-encoded" rule is defined in [URI]:

  xmppiri    = "xmpp" ":" ihierxmpp
               [ "?" iquerycomp ]
               [ "#" ifragment ]
  ihierxmpp  = iauthpath / ipathxmpp
  iauthpath  = "//" iauthxmpp [ "/" ipathxmpp ]
  iauthxmpp  = inodeid "@" ihost
  ipathxmpp  = [ inodeid "@" ] ihost [ "/" iresid ]
  inodeid    = *( iunreserved / pct-encoded / nodeallow )
  nodeallow  = "!" / "$" / "(" / ")" / "*" / "+" / "," / ";" / "="
  iresid     = *( iunreserved / pct-encoded / resallow )
  resallow   = "!" / "$" / "&" / "'" / "(" / ")" /
               "*" / "+" / "," / ":" / ";" / "="
  iquerycomp = iquerytype [ *ipair ]
  iquerytype = *iunreserved
  ipair      = ";" ikey "=" ivalue
  ikey       = *iunreserved
  ivalue     = *( iunreserved / pct-encoded )

BUT (and this is the tea ☕) that syntax can't go in the registration for the xmpp URI scheme, because IANA only recognizes URI schemes and not IRI schemes 🥺 so the ABNF syntax for an XMPP URI, rather than an IRI, is defined in Section 3.3 of this document. if you ever need to convert IRI syntax into URI syntax, an application MUST adhere to the mapping procedure in Section 3.1 of [IRI] 🧚

here's a basic XMPP IRI/URI that identifies a node on an XMPP server:

      xmpp:node@example.com

the various components of an XMPP IRI/URI are described in the following sections 📚

2.3. Authority Component 🎀

as explained in Section 2.8 of this document, if there's no authority component, the processing application would authenticate as a configured user at a configured XMPP server. so the authority component section is unnecessary and should be ignored if the processing application has been configured with a set of default credentials. 🫶

per Section 3.2 of RFC 3986 [URI], the authority component starts with a double slash ("//") and ends at the next slash ("/"), question mark ("?"), or number sign ("#") character, or at the end of the IRI/URI. as Section 2.8.1 of this document explains more fully, having an authority component tells the processing application to authenticate as the node@domain in the authority component instead of a configured node@domain (see the Security Considerations section of this document about authentication). (ngl, the authority component probably won't show up in most XMPP IRIs or URIs, but the scheme allows it if it makes sense 🙈) so this one tells the app to authenticate as "guest@example.com":

      xmpp://guest@example.com

the vibes are totally different here 💅 this next one identifies a node "guest@example.com" but does NOT tell the processing application to authenticate as that node:

      xmpp:guest@example.com

and using a possible query component of "?message" to trigger a message-sending interface, this one tells the processing application to authenticate as "guest@example.com" and send a message to "support@example.com":

      xmpp://guest@example.com/support@example.com?message

by contrast, this one tells the processing application to authenticate as its configured default account and send a message to "support@example.com" 🍓

      xmpp:support@example.com?message

2.4. Path Component 🧚‍♀️

the path component of an XMPP IRI/URI identifies an XMPP address, or specifies the XMPP address that an XML stanza shall be directed to at the end of IRI/URI processing. ✨

for example, this XMPP IRI/URI identifies a node on an XMPP server:

      xmpp:example-node@example.com

this one identifies a node on an XMPP server along with a particular XMPP resource identifier tied to that node:

      xmpp:example-node@example.com/some-resource

including a node is optional in XMPP addresses, so this XMPP IRI/URI just identifies an XMPP server 🌈

      xmpp:example.com

2.5. Query Component 💜

there are SO many potential use cases for packing info into the query component of an XMPP IRI/URI, so you can suggest interaction semantics (see Section 2.1). examples include, but aren't limited to: 🫠

sending an XMPP message stanza (see [XMPP-IM]),
adding a roster item (see [XMPP-IM]),
sending a presence subscription (see [XMPP-IM]),
probing for current presence information (see [XMPP-IM]),
triggering a remote procedure call (see [XEP-0009]),
discovering the identity or capabilities of another entity (see [XEP-0030]),
joining an XMPP-based text chat room (see [XEP-0045]),
interacting with publish-subscribe channels (see [XEP-0060]),
providing a SOAP interface (see [XEP-0072]), and
registering with another entity (see [XEP-0077]).

a lot of these use cases are application specific, and nobody can predict every application, especially with XMPP development always expanding 🚀 BUT the Jabber/XMPP developer community agrees that every use they've come up with so far can be wrapped up in a "query type", optionally with one or more "key-value" pairs (this is kind of like the "application/x-www-form-urlencoded" MIME type described in [HTML]) 🎀

for example, an XMPP IRI/URI meant to open an interface for sending a message to the XMPP entity "example-node@example.com" could look like this:

      xmpp:example-node@example.com?message

and an XMPP IRI/URI meant to open an interface for sending a message to "example-node@example.com" with a particular subject could look like this:

      xmpp:example-node@example.com?message;subject=Hello%20World

if the processing application doesn't understand query components or the specified query type, it MUST ignore the query component and treat the IRI/URI as consisting of, for example, <xmpp:example-node@example.com> rather than <xmpp:example-node@example.com?query>. and if the processing application doesn't understand a particular key within the query component, it MUST ignore that key and its associated value. 🚫

as I mentioned, there are tons of XMPP applications (real and potential), and they may define query types and keys for the query component of XMPP URIs 💖 the XMPP Registrar function (see [XEP-0053]) of the XMPP Standards Foundation keeps a registry of these query types and keys at http://www.xmpp.org/registrar/querytypes.html. to help keep things interoperable, any application using the formats in this document SHOULD submit its query types and keys to that registry following the procedures in [XEP-0147] 🫶

Note: the delimiter between key-value pairs is the ";" character, not the "&" character used in lots of other URI schemes. this one was picked to avoid escaping problems with the & character in HTML and XML applications 🙈

2.6. Fragment Identifier Component 🦋

as Section 3.5 of [URI] says, "The fragment identifier component of a URI allows indirect identification of a secondary resource by reference to a primary resource and additional identifying information." 📖 an XMPP IRI/URI's resource doesn't offer any media type (see [MIME]), so (in the terminology of [URI]) there's no representation at an XMPP resource. that means the semantics of the fragment identifier component in XMPP IRIs/URIs are "considered unknown and, effectively, unconstrained" (ibid.) 🌸 particular XMPP applications MAY use the fragment identifier component for their own purposes. however, if a processing application doesn't understand fragment identifier components, or the syntax of a particular fragment identifier component in an XMPP IRI/URI, it MUST ignore that fragment identifier component. 🍓

2.7. Generation of XMPP IRIs/URIs ✨

2.7.1. Generation Method

Okay so, making an XMPP IRI is a whole process, bestie 🎀 First, your XMPP address has to be totally legit. The generating application MUST first ensure that the XMPP address conforms to the rules specified in [XMPP-CORE], including encoding as a UTF-8 [UTF-8] string and application of the relevant stringprep profiles [STRINGPREP]. Then, since IRI syntax [IRI] says the characters in an IRI are the original Unicode characters themselves [UNICODE], the generating application MUST decode the UTF-8 [UTF-8] characters of a native XMPP address back to their original Unicode form. ✨ After that, the generating application then MUST concatenate the following:

The "xmpp" scheme and the ":" character.
Optionally (if an authority component is to be included before the node identifier), the characters "//", an authority component of the form node@domain, and the character "/". 🦋
Optionally (if the XMPP address contained an XMPP "node identifier"), a string of Unicode characters that conforms to the "inodeid" rule, followed by the "@" character.
A string of Unicode characters that conforms to the "ihost" rule.
Optionally (if the XMPP address contained an XMPP "resource identifier"), the character "/" and a string of Unicode characters that conforms to the "iresid" rule.
Optionally (if a query component is to be included), the "?" character and query component.
Optionally (if a fragment identifier component is to be included), the "#" character and fragment identifier component.

To get an XMPP URI from the resulting IRI, an application MUST adhere to the mapping procedure specified in Section 3.1 of [IRI]. Main character energy, no cap 💅

2.7.2. Generation Notes

Okay, real talk: some characters are allowed in a native XMPP address but are NOT allowed in an XMPP IRI 🙈 The "inodeid", "ihost", and "iresid" rules are picky about these. The "#" and "?" characters are allowed in node identifiers, and the "/", "?", "#", and "@" characters are allowed in resource identifiers. Those same characters are delimiters in XMPP IRIs, though, so they cause chaos. The " " ([US-ASCII] space) character is allowed in resource identifiers but prohibited in IRIs. So all the foregoing characters MUST be percent-encoded when transforming an XMPP address into an XMPP IRI. Iykyk 🌸

Here's a super nasty node in an XMPP address:

nasty!#$%()*+,-.;=?[\]^_`{|}~node@example.com

That address would be transformed into the following XMPP IRI (split into two lines for layout purposes):

xmpp:nasty!%23$%25()*+,-.;=%3F%5B%5C%5D%5E_%60%7B%7C%7D~node
@example.com

And here's a repulsive resource in an XMPP address (split into two lines for layout purposes):

node@example.com
/repulsive !#"$%&'()*+,-./:;<=>?@[\]^_`{|}~resource

That address would be transformed into the following XMPP IRI (split into three lines for layout purposes):

xmpp:node@example.com
/repulsive%20!%23%22$%25&'()*+,-.%2F:;%3C=
%3E%3F%40%5B%5C%5D%5E_%60%7B%7C%7D~resource

Furthermore, basically any character outside the US-ASCII range [US-ASCII] is allowed in an XMPP address, and therefore also in an XMPP IRI 🌈 But URI syntax forbids those characters directly, so they MUST be percent-encoded. To figure out the URI associated with an XMPP IRI, an application MUST adhere to the mapping procedure specified in Section 3.1 of [IRI].

This table can help implementors understand the respective encodings and "carrier units" of the identifiers discussed in this document, namely: (1) native XMPP addresses, (2) IRIs, and (3) URIs. For details, refer to Section 3.5 of this document as well as Section 3 of [XMPP-CORE], Section 6.4 of [IRI], and Section 2 of [URI]. 📊

+--------------+-----------+-----------+
| Identifier   | Encoding  | Units     |
+--------------+-----------+-----------+
| XMPP address | UTF-8     | Octets    |
+--------------+-----------+-----------+
| IRI          | Unicode   | 16/32-bit |
|              |           | values    |
+--------------+-----------+-----------+
| URI          | Percent-  | US-ASCII  |
|              | encoded   |           |
|              | UTF-8     |           |
+--------------+-----------+-----------+

2.7.3. Generation Example

Let's look at a super cute example 🧚 Consider the following XMPP address:

      <ji&#x159;i@&#x10D;echy.example/v Praze>

Note: The string "ř" stands for the Unicode character LATIN SMALL LETTER R WITH CARON, and the string "č" stands for the Unicode character LATIN SMALL LETTER C WITH CARON. The "&#x..." form is used in this document as a notational device to represent Unicode characters, following the "XML Notation" used in [IRI] to represent characters that cannot be rendered in ASCII-only documents. An XMPP IRI MUST contain the Unicode characters themselves, not the representation in XML Notation (in particular, note that the "#" character is forbidden in IRI syntax). An XMPP URI MUST properly escape such characters, as described below. The '<' and '>' characters are not part of the address itself but are provided to set off the address for legibility. (For those who do not understand the Czech language, this example could be Anglicized as "george@czech-lands.example/In Prague".) 🦋

In accordance with the process specified above, the generating application would do the following to generate a valid XMPP IRI from this address:

Ensure that the XMPP address conforms to the rules specified in [XMPP-CORE], including application of the relevant stringprep profiles [STRINGPREP] and encoding as a UTF-8 string [UTF-8].
Concatenate the following:
1. The "xmpp" scheme and the ":" character.
2. An "authority component" if included (not shown in this example).
3. A string of Unicode characters that represents the XMPP address, transformed in accordance with the "inodeid", "ihost", and "iresid" rules.
4. The "?" character followed by a "query component" if appropriate to the application (not shown in this example).
5. The "#" character followed by a "fragment identifier component" if appropriate to the application (not shown in this example).

The result is the following XMPP IRI (note again that, in accordance with the "XML Notation" used in [IRI], the string "ř" stands for the Unicode character LATIN SMALL LETTER R WITH CARON and the string "č" stands for the Unicode character LATIN SMALL LETTER C WITH CARON; an XMPP IRI would contain the Unicode characters themselves). 💅

      <xmpp:ji&#x159;i@&#x10D;echy.example/v%20Praze>

To generate a valid XMPP URI from the foregoing IRI, the application MUST adhere to the procedure specified in Section 3.1 of [IRI], resulting in the following URI:

      <xmpp:ji%C5%99i@%C4%8Dechy.example/v%20Praze>

2.8. Processing of XMPP IRIs/URIs

2.8.1. Processing Method

Now the other direction, bestie 🌸 If a processing application gets an XMPP URI and NOT an XMPP IRI, it MUST first convert the URI into an IRI by following the procedure specified in Section 3.2 of [IRI].

To break an XMPP IRI apart so it can talk to the entity it identifies, a processing application MUST separate:

The "xmpp" scheme and the ":" character.
The authority component, if included (the string of Unicode characters between the "//" characters and the next "/" character, the "?" character, the "#" character, or the end of the IRI).
A string of Unicode characters that represents an XMPP address as transformed in accordance with the "inodeid", "ihost", and "iresid" rules.
Optionally the query component, if included, using the "?" character as a separator.
Optionally the fragment identifier component, if included, using the "#" character as a separator.

At this point, the processing application MUST ensure that the resulting XMPP address conforms to the rules specified in [XMPP-CORE], including application of the relevant stringprep profiles [STRINGPREP]. The processing application then would either (1) complete further XMPP handling itself or (2) invoke a helper application to complete XMPP handling; such XMPP handling would most likely consist of the following steps: 🎀

If not already connected to an XMPP server, connect either as the user specified in the authority component or as the configured user at the configured XMPP server, normally by adhering to the XMPP connection procedures defined in [XMPP-CORE]. (Note: The processing application SHOULD ignore the authority component if it has been configured with a set of default credentials.) 🙈
Optionally, determine the nature of the intended recipient (e.g., via [XEP-0030]).
Optionally, present an appropriate interface to a user based on the nature of the intended recipient and/or the contents of the query component.
Generate an XMPP stanza that translates any user or application inputs into their corresponding XMPP equivalents.
Send the XMPP stanza via the authenticated server connection for delivery to the intended recipient.

2.8.2. Processing Notes

It may help implementors to know that the first two steps of "further XMPP handling", as described at the end of Section 2.8.1, are similar to HTTP authentication [HTTP-AUTH], while the next three steps are similar to the handling of mailto: URIs [MAILTO]. 🧚

As noted in Section 2.7.2 of this document, certain characters are allowed in the node identifier, domain identifier, and resource identifier portions of a native XMPP address but prohibited by the "inodeid", "ihost", and "iresid" rules of an XMPP IRI. The percent-encoded octets corresponding to these characters in XMPP IRIs MUST be transformed into the characters allowed in XMPP addresses when processing an XMPP IRI for interaction with the represented XMPP entity. 💖

Consider the following nasty node in an XMPP IRI (split into two lines for layout purposes):

xmpp:nasty!%23$%25()*+,-.;=%3F%5B%5C%5D%5E_%60%7B%7C%7D~node
@example.com

That IRI would be transformed into the following XMPP address:

nasty!#$%()*+,-.;=?[\]^_`{|}~node@example.com

Consider the following repulsive resource in an XMPP IRI (split into three lines for layout purposes):

xmpp:node@example.com
/repulsive%20!%23%22$%25&'()*+,-.%2F:;%3C
=%3E%3F%40%5B%5C%5D%5E_%60%7B%7C%7D~resource

That IRI would be transformed into the following XMPP address (split into two lines for layout purposes):

node@example.com
/repulsive !#"$%&'()*+,-./:;<=>?@[\]^_`{|}~resource

2.8.3. Processing Example ✨

okay bestie, let's walk through this one together 🎀 Take the XMPP URI we got from the last example (see Section 2.7.3):

<xmpp:ji%C5%99i@%C4%8Dechy.example/v%20Praze>

To turn that URI into a valid XMPP IRI, the application MUST adhere to the procedure specified in Section 3.2 of [IRI] 💅 Doing that gives you this IRI:

<xmpp:ji&#x159;i@&#x10D;echy.example/v%20Praze>

So the processing application follows the process from above. It drops the "xmpp" scheme and the ":" character to pull out the XMPP address 🦋 It also turns any percent-encoded octets from the "inodeid", "ihost", and "iresid" rules back into their character equivalents, so "%20" becomes the space character.

The result is this XMPP address:

<ji&#x159;i@&#x10D;echy.example/v Praze>

2.9. Internationalization 🌈

okay, this part is lowkey my favorite 😭 XMPP addresses are UTF-8 strings [UTF-8], and any octets outside the US-ASCII range [US-ASCII] inside an XMPP address can easily be turned into percent-encoded octets. That's why XMPP addresses work so well with Internationalized Resource Identifiers [IRI] 🌸

There are a few exceptions: stringprep verification, converting syntax-relevant US-ASCII characters (e.g., "?"), and converting percent-encoded octets from the "inodeid", "ihost", and "iresid" rules into their character equivalents (e.g., "%20" into the US-ASCII space character). Other than those, you can make an XMPP IRI straight from an XMPP address by sticking the "xmpp" scheme and ":" character on the front 🧚 An XMPP IRI can also be converted into URI syntax by following the procedure in Section 3.1 of [IRI], and an XMPP URI can be converted into IRI syntax by following the procedure in Section 3.2 of [IRI]. That keeps things interoperable with applications that can process URIs but can't process IRIs 💖

3. IANA Registration of xmpp URI Scheme 🦋

In accordance with [URI-SCHEMES], this section gives you all the info needed to register the xmpp URI scheme. Let's go, bestie ✨

3.1. URI Scheme Name 🍓

xmpp

3.2. Status 💜

permanent

3.3. URI Scheme Syntax 🎀

The syntax for an xmpp URI is defined below using Augmented Backus-Naur Form as specified by [ABNF]. The "fragment", "host", "pct-encoded", and "unreserved" rules are defined in [URI]:

  xmppuri   = "xmpp" ":" hierxmpp [ "?" querycomp ] [ "#" fragment ]
  hierxmpp  = authpath / pathxmpp
  authpath  = "//" authxmpp [ "/" pathxmpp ]
  authxmpp  = nodeid "@" host
  pathxmpp  = [ nodeid "@" ] host [ "/" resid ]
  nodeid    = *( unreserved / pct-encoded / nodeallow )
  nodeallow = "!" / "$" / "(" / ")" / "*" / "+" / "," / ";" / "="
  resid     = *( unreserved / pct-encoded / resallow )
  resallow  = "!" / "$" / "&" / "'" / "(" / ")" /
               "*" / "+" / "," / ":" / ";" / "="
  querycomp = querytype [ *pair ]
  querytype = *( unreserved / pct-encoded )
  pair      = ";" key "=" value
  key       = *( unreserved / pct-encoded )
  value     = *( unreserved / pct-encoded )

3.4. URI Scheme Semantics 🦋

The xmpp URI scheme identifies entities that natively talk using the Extensible Messaging and Presence Protocol (XMPP). It's mainly used for identification rather than resource location 💅 But if an application that processes an xmpp URI wants to enable interaction with the XMPP address the URI identifies, it MUST follow the methodology defined in Section 2 of this document, Use of XMPP IRIs and URIs. That's how it rebuilds the encapsulated XMPP address, connects to an appropriate XMPP server, and sends an appropriate XMPP "stanza" (XML fragment) to that address 🫶 (Note: There is no MIME type associated with the xmpp URI scheme.)

3.5. Encoding Considerations 🌸

There will also be XMPP Internationalized Resource Identifiers (IRIs), in addition to XMPP URIs. Before an Extensible Messaging and Presence Protocol (XMPP) address gets turned into an IRI (and following [XMPP-CORE]), the generating application must represent the address as a string of UTF-8 characters [UTF-8]. For example, it could transform the application's internal UTF-16 string into a UTF-8 string 🧚

IRI syntax [IRI] says the characters in an IRI are the original Unicode characters themselves [UNICODE]. So when generating an XMPP IRI, the generating application MUST decode the UTF-8 characters of a native XMPP address back to their original Unicode form. URI syntax [URI] says the characters in a URI are US-ASCII characters [US-ASCII] only. So when generating an XMPP URI, the generating application MUST escape the Unicode characters of an XMPP IRI to US-ASCII characters, following the procedure specified in RFC 3987 💖

3.6. Applications/Protocols That Use This URI Scheme Name 🌈

The xmpp URI scheme is meant to be used by interfaces to an XMPP network from non-native user agents, like web browsers. It's also meant for non-native applications that need to identify XMPP entities as full URIs or IRIs 👑

3.7. Interoperability Considerations 💅

There are no known interoperability concerns with the xmpp URI scheme 🙌 To help keep things interoperable anyway, the XMPP Registrar function of the XMPP Standards Foundation maintains a registry of query types and keys that can be used in the query components of XMPP URIs and IRIs. You can find it at <http://www.xmpp.org/registrar/querytypes.html>.

3.8. Security Considerations 🔥

See Section 5 of this document, Security Considerations.

3.9. Contact 🦋

Peter Saint-Andre [mailto:stpeter@jabber.org, xmpp:stpeter@jabber.org]

3.10. Author/Change Controller 💜

This scheme is registered under the IETF tree. That means the IETF maintains change control ✨

3.11. References 🧚

[XMPP-CORE]

4. IANA Considerations 🎀

This document obsoletes the URI scheme registration created by RFC 4622. The registration template is in Section 3 of this document. Again, to help keep things interoperable, the XMPP Registrar function of the XMPP Standards Foundation maintains a registry of query types and keys that can be used in the query components of XMPP URIs and IRIs. It lives at <http://www.xmpp.org/registrar/querytypes.html> 🌸

5. Security Considerations 🔥

okay, this part is serious, bestie, so pay attention 😭 Giving non-native applications an interface to XMPP services introduces new security concerns. The security considerations discussed in [IRI], [URI], and [XMPP-CORE] apply to XMPP IRIs. The security considerations discussed in [URI] and [XMPP-CORE] apply to XMPP URIs. In accordance with Section 2.7 of [URI-SCHEMES] and Section 7 of [URI], particular security considerations are specified in the following sections 💀

5.1. Reliability and Consistency 🫶

XMPP addresses of the form node@domain.tld are usually created by registering at an XMPP server, or they're provisioned by an administrator of that server. So it's possible that such addresses might be unregistered or deprovisioned later. That means the XMPP IRI/URI identifying such an XMPP address may not reliably and consistently be associated with the same principal, account owner, application, or device 🙈

XMPP addresses of the form node@domain.tld/resource are usually even more ephemeral, since a given XMPP resource identifier is usually tied to a particular, temporary session of an XMPP client at an XMPP server. So the XMPP IRI/URI identifying such an XMPP address probably won't reliably and consistently be associated with the same session. However, the procedures specified in Section 10 of [XMPP-CORE] effectively get rid of any potential confusion caused by that lack of reliability and consistency 💅

XMPP addresses of the form domain.tld are usually long-lived XMPP servers or associated services. Server or service administrators can always decommission the server or service at any time, but usually the IRIs/URIs identifying those servers or services are the most reliable and consistent XMPP IRIs/URIs out there 👑

XMPP addresses of the form domain.tld/resource aren't common on XMPP networks yet. Still, the reliability and consistency of XMPP IRIs/URIs identifying such addresses would likely land somewhere between those identifying addresses of the form domain.tld and those identifying addresses of the form node@domain.tld 🦋

5.2. Malicious Construction 🔥

Malicious construction of XMPP IRIs/URIs is made less likely by the prohibition on port numbers in XMPP IRIs/URIs. That's because port numbers are supposed to be discovered using DNS SRV records [DNS-SRV], as specified in [XMPP-CORE] 🌈

5.3. Back-End Transcoding 💜

The base XMPP protocol is designed to exchange messages and presence information, not to retrieve files or invoke similar system functions. So it's considered unlikely that using XMPP IRIs/URIs would result in harmful dereferencing 🧚 However, if an XMPP protocol extension defines methods for information retrieval, it MUST define appropriate controls over access to that information. Also, XMPP servers SHOULD NOT natively parse XMPP IRIs/URIs. Instead, they SHOULD accept only the XML wire protocol specified in [XMPP-CORE] and any desired extensions to it 🎀

5.4. Sensitive Information 🌸

Letting people interact with XMPP entities through a web browser or another non-native application can expose sensitive information, like support for particular XMPP application protocol extensions. That can make attacks possible, or more likely, that wouldn't be on a native XMPP network 😭 Due care must be taken in deciding what information is appropriate to show in XMPP IRIs or URIs.

Also, advertising XMPP IRIs/URIs in publicly accessible places (like websites) may make it easier for malicious users to harvest XMPP addresses from the authority and path components of XMPP IRIs/URIs. That means they could send unsolicited bulk communications to the users or applications represented by those addresses 🙈 Due care should be taken to balance the benefits of open information exchange against the potential costs of unwanted communications.

To help prevent leaking sensitive information, passwords and other user credentials are forbidden in the authority component of XMPP IRIs/URIs. Honestly they aren't even needed, because XMPP authentication happens via the Simple Authentication and Security Layer [SASL], which makes it possible to use the SASL ANONYMOUS mechanism if desired 💖

5.5. Semantic Attacks 💀

Even though non-hierarchical URI schemes like [MAILTO] exist, people might by association expect every URI to include the "//" characters after the scheme name and ":" character. But in XMPP IRIs/URIs, the "//" characters come before the authority component rather than the path component. So xmpp://guest@example.com means to authenticate as "guest@example.com", whereas xmpp:guest@example.com identifies the node "guest@example.com" 🙃 Processing applications MUST clearly differentiate between these forms. User agents SHOULD discourage human users from including the "//" characters in XMPP IRIs/URIs, since the authority component is only envisioned to be helpful in specialized scenarios, not more generally 🌈

5.6. Spoofing 🎭

okay so this one is a little spicy 🌶️ Because XMPP IRIs can hold basically the whole Unicode range, they can make certain kinds of address mimicking (aka spoofing) easier to pull off 👀 BUT ngl, XMPP IRIs aren't special here. They work just like every other IRI on this front. So any app that's going to show XMPP IRIs to real humans must follow the best practices for address mimicking to help stop spoofed-address attacks, like the phishing 🎣 scams everyone's heard about. For the full tea, check the Security Considerations of [IRI] 💅

6. Acknowledgements 🫶

huge thanks to Martin Duerst, Lisa Dusseault, Frank Ellerman, Roy Fielding, Joe Hildebrand, and Ralph Meijer for their comments 💖

7. References 📚

7.1. Normative References

these are the must-reads 🤓

[ABNF] Crocker, D. and P. Overell, "Augmented BNF for Syntax Specifications: ABNF", STD 68, RFC 5234, January 2007.
[IRI] Duerst, M. and M. Suignard, "Internationalized Resource Identifiers (IRIs)", RFC 3987, January 2005.
[TERMS] Bradner, S., "Key words for use in RFCs to Indicate Requirement Levels", BCP 14, RFC 2119, March 1997.
[URI] Berners-Lee, T., Fielding, R., and L. Masinter, "Uniform Resource Identifier (URI): Generic Syntax", STD 66, RFC 3986, January 2005.
[XMPP-CORE] Saint-Andre, P., "Extensible Messaging and Presence Protocol (XMPP): Core", RFC 3920, October 2004.

7.2. Informative References

these are the bonus reads that give extra context 🌸

[CPIM] Peterson, J., "Common Profile for Instant Messaging (CPIM)", RFC 3860, August 2004.
[CPP] Peterson, J., "Common Profile for Presence (CPP)", RFC 3859, August 2004.
[DNS-SRV] Gulbrandsen, A., Vixie, P., and L. Esibov, "A DNS RR for specifying the location of services (DNS SRV)", RFC 2782, February 2000.
[HTML] Raggett, D., "HTML 4.0 Specification", W3C REC REC-html40-19980424, April 1998.
[HTTP-AUTH] Franks, J., Hallam-Baker, P., Hostetler, J., Lawrence, S., Leach, P., Luotonen, A., and L. Stewart, "HTTP Authentication: Basic and Digest Access Authentication", RFC 2617, June 1999.
[IDNA] Faltstrom, P., Hoffman, P., and A. Costello, "Internationalizing Domain Names in Applications (IDNA)", RFC 3490, March 2003.
[MAILTO] Hoffman, P., Masinter, L., and J. Zawinski, "The mailto URL scheme", RFC 2368, July 1998.
[MIME] Freed, N. and N. Borenstein, "Multipurpose Internet Mail Extensions (MIME) Part Two: Media Types", RFC 2046, November 1996.
[SASL] Melnikov, A. and K. Zeilenga, "Simple Authentication and Security Layer (SASL)", RFC 4422, June 2006.
[STRINGPREP] Hoffman, P. and M. Blanchet, "Preparation of Internationalized Strings ("STRINGPREP")", RFC 3454, December 2002.
[UNICODE] The Unicode Consortium, "The Unicode Standard, Version 3.2.0", 2000.

The Unicode Standard, Version 3.2.0 is defined by The Unicode Standard, Version 3.0 (Reading, MA, Addison-Wesley, 2000. ISBN 0-201-61633-5), as amended by the Unicode Standard Annex #27: Unicode 3.1 (http://www.unicode.org/reports/tr27/) and by the Unicode Standard Annex #28: Unicode 3.2 (http://www.unicode.org/reports/tr28/).

[URI-SCHEMES] Hansen, T., Hardie, T., and L. Masinter, "Guidelines and Registration Procedures for New URI Schemes", RFC 4395, February 2006.
[US-ASCII] American National Standards Institute, "Coded Character Set - 7-bit American Standard Code for Information Interchange", ANSI X3.4, 1986.
[UTF-8] Yergeau, F., "UTF-8, a transformation format of ISO 10646", STD 63, RFC 3629, November 2003.
[XEP-0009] Adams, D., "Jabber-RPC", XSF XEP 0009, February 2006.
[XEP-0030] Hildebrand, J., Millard, P., Eatmon, R., and P. Saint-Andre, "Service Discovery", XSF XEP 0030, February 2007.
[XEP-0045] Saint-Andre, P., "Multi-User Chat", XSF XEP 0045, April 2007.
[XEP-0053] Saint-Andre, P., "XMPP Registrar Function", XSF XEP 0053, December 2006.
[XEP-0060] Millard, P., Saint-Andre, P., and R. Meijer, "Publish-Subscribe", XSF XEP 0060, September 2006.
[XEP-0072] Forno, F. and P. Saint-Andre, "SOAP Over XMPP", XSF XEP 0072, December 2005.
[XEP-0077] Saint-Andre, P., "In-Band Registration", XSF XEP 0077, January 2006.
[XEP-0147] Saint-Andre, P., "XMPP URI Scheme Query Components", XSF XEP 0147, September 2006.
[XMPP-IM] Saint-Andre, P., "Extensible Messaging and Presence Protocol (XMPP): Instant Messaging and Presence", RFC 3921, October 2004.

Appendix A. Differences from RFC 4622 🔍

several errors were found in RFC 4622, and this document fixes them. Here's what changed:

Specified that the characters "[", "\", "]", "^", "`", "{", "|", and "}" are allowed in XMPP node identifiers but not allowed in IRIs or URIs according to the sub-delims rule.
Specified that the characters '"', "<", ">", "[", "\", "]", "^", "`", "{", "|", and "}" are allowed in XMPP resource identifiers but not allowed in IRIs or URIs according to the pchar rule.
Specified that the foregoing characters must be percent-encoded when constructing an XMPP URI.
Corrected the ABNF accordingly.
Updated the examples accordingly.

Appendix B. Copying Conditions 📜

Regarding this entire document or any portion of it, the author makes no guarantees and is not responsible for any damage resulting from its use. The author grants irrevocable permission to anyone to use, modify, and distribute it in any way that does not diminish the rights of anyone else to use, modify, and distribute it, provided that redistributed derivative works do not contain misleading author or version information. Derivative works need not be licensed under similar terms.

Author's Address 💌

Peter Saint-Andre
XMPP Standards Foundation

EMail: stpeter@jabber.org
URI:   xmpp:stpeter@jabber.org

This document is subject to the rights, licenses and restrictions contained in BCP 78, and except as set forth therein, the authors retain all their rights.

This document and the information contained herein are provided on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY, THE IETF TRUST AND THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.

Intellectual Property 🦋

The IETF takes no position regarding the validity or scope of any Intellectual Property Rights or other rights that might be claimed to pertain to the implementation or use of the technology described in this document or the extent to which any license under such rights might or might not be available; nor does it represent that it has made any independent effort to identify any such rights. Information on the procedures with respect to rights in RFC documents can be found in BCP 78 and BCP 79.

Copies of IPR disclosures made to the IETF Secretariat and any assurances of licenses to be made available, or the result of an attempt made to obtain a general license or permission for the use of such proprietary rights by implementers or users of this specification can be obtained from the IETF on-line IPR repository at http://www.ietf.org/ipr.

The IETF invites any interested party to bring to its attention any copyrights, patents or patent applications, or other proprietary rights that may cover technology that may be required to implement this standard. Please address the information to the IETF at ietf-ipr@ietf.org.

bestie, that's the whole RFC 5122 wrapped up 🎀🌈 you made it through all five parts!! ✨

📦 where this page comes from

ietf: rfc5122 2008-02
💖 girlified by claude-haiku-5-5 on 2026-10-17: a language model's rewrite of the original, under its terms