RFC 8124

The Session Description Protocol (SDP) WebSocket Connection URI Attribute

📅 published March 2017, from ietf

RFC 8124: The Session Description Protocol (SDP) WebSocket Connection URI Attribute 💖

Okay bestie, this is RFC 8124, titled The Session Description Protocol (SDP) WebSocket Connection URI Attribute 🦋. It was written by R. Ravindranath and G. Salgueiro, both at Cisco, and published in March 2017. It's a Standards Track document with ISSN 2070-1721, so it's an official Internet standard, not just a suggestion 💅. Its header has no "Obsoletes" or "Updates" line, so it doesn't replace or change any older RFC 🌸.

Table of Contents 🎀

   1. Introduction ....................................................2
   2. Terminology .....................................................3
   3. SDP Considerations ..............................................3
      3.1. General ....................................................3
      3.2. "websocket-uri" SDP Attribute ..............................4
      3.3. "websocket-uri" Multiplexing Considerations ................4
   4. SDP Offer/Answer Procedures .....................................5
      4.1. General ....................................................5
      4.2. Generating the Initial Offer ...............................5
      4.3. Generating the Answer ......................................6
      4.4. Offerer Processing of the Answer ...........................7
      4.5. Modifying the Session ......................................7
      4.6. Offerless INVITE Scenarios .................................8
   5. Procedures at WebSocket Client ..................................8
   6. Security Considerations .........................................9
   7. IANA Considerations .............................................9
      7.1. Registration of the "websocket-uri" SDP Media Attribute ....9
   8. References .....................................................10
      8.1. Normative References ......................................10
      8.2. Informative References ....................................10
   Acknowledgements ..................................................12
   Authors' Addresses ................................................12

Abstract ✨

The WebSocket protocol lets clients and servers in web apps talk to each other in both directions, in real time 💬. This document adds extensions to the Session Description Protocol (SDP) for application protocols that use WebSocket as their transport 🌈.

Status of This Memo 🧾

This is an Internet Standards Track document 💜.

This document comes from the Internet Engineering Task Force (IETF). It reflects what the IETF community agreed on, got public review, and was approved for publication by the Internet Engineering Steering Group (IESG). For more on Internet Standards, check Section 2 of RFC 7841 📚.

For the current status, any errata, and how to send feedback, go to http://www.rfc-editor.org/info/rfc8124 🔗.

Copyright Notice ⚖️

This document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info), as in effect on the date this document was published. Please read these carefully, because they explain your rights and restrictions for this document. Code Components pulled out of this document must include Simplified BSD License text, as described in Section 4.e of the Trust Legal Provisions, and they come without warranty, as described in the Simplified BSD License 📜.

1. Introduction 🦋

Okay so the WebSocket protocol [RFC6455] lets clients and servers send messages back and forth on a persistent TCP connection 🔁. That connection can optionally be secured with Transport Layer Security (TLS) [RFC5246]. The opening handshake uses Hypertext Transfer Protocol (HTTP) [RFC7230] semantics, so WebSocket can reuse all the existing HTTP infrastructure, which is honestly so smart 🧠✨.

Modern web browsers ship with a WebSocket client stack that follows the WebSocket API [WS-API] from the W3C 🌐. Other client apps (like the ones on personal computers, mobile devices, and so on) are expected to get a WebSocket client stack too 📱💻. A bunch of specs already describe how different apps can use a WebSocket subprotocol as a reliable transport mechanism 🧚.

For example, [RFC7118] defines a WebSocket subprotocol as a reliable transport between Session Initiation Protocol (SIP) [RFC3261] entities, so SIP can be used in web-oriented deployments 📞. [RFC7977] defines a new WebSocket subprotocol as a reliable transport between Message Session Relay Protocol (MSRP) clients and relays 💌. [RFC7395] defines a WebSocket subprotocol for the Extensible Messaging and Presence Protocol (XMPP) 💬. And [BFCP-WEBSOCKET] defines a WebSocket subprotocol as a reliable transport between Binary Floor Control Protocol (BFCP) [BFCP] entities, so BFCP can be used in brand-new scenarios 🎀.

When a WebSocket subprotocol is the transport between a server and a client, the server needs a way to tell the WebSocket client what the connection URI is 🗝️. For apps that negotiate with Session Description Protocol (SDP) [RFC4566], the connection URI can be sent as an SDP attribute 🌸. This spec defines new SDP attributes that carry the connection URI for the WebSocket client 💅. Apps that use SDP for negotiation and WebSocket as their transport can use this spec to advertise the WebSocket client connection URI 🫶.

2. Terminology 📖

The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "NOT RECOMMENDED", "MAY", and "OPTIONAL" in this document are to be interpreted as described in [RFC2119] 🔑.

3. SDP Considerations 🌷

3.1. General 💫

Apps that use the SDP Offer/Answer mechanism [RFC3264] to negotiate media, and that also use WebSocket or secure WebSocket as their transport protocol, MAY indicate the connection URI for the WebSocket client through a new SDP "a=" media-level attribute defined in Section 3.2 ✨.

3.2. "websocket-uri" SDP Attribute 🎀

This section defines a new SDP media-level attribute called "websocket-uri", which can show up in any of the media sections 🦋.

Example:

a=websocket-uri:wss://example.com/chat

Here, "wss://example.com/chat" is the ws-URI defined in Section 3 of [RFC6455] 🔗.

When the "websocket-uri" attribute is in the media section of the SDP, the IP address in the "c=" line SHALL be ignored, and the full URI SHALL be used to open the WebSocket connection instead 🙈. Clients MUST make sure they use the URI to open the WebSocket connection, and they MUST ignore both the IP address in the "c=" line and the port in the "m=" line 🚫.

3.3. "websocket-uri" Multiplexing Considerations 🧩

The multiplexing characteristics of SDP attributes are described in [SDP-MUX], which introduces the different SDP attribute multiplexing categories 📚.

The multiplexing category of the "a=websocket-uri" attribute is CAUTION ⚠️.

There are no multiplexing rules specified for the "websocket-uri" SDP media-level attribute. On top of that, writing multiplexing rules for the "websocket-uri" attribute is outside the scope of this document 🙃.

Okay so it's technically possible to bundle WebSocket, but there are a bunch of reasons that make it impractical, so it's considered unlikely to be used in practice 🤷‍♀️. That means the "websocket-uri" SDP media-level attribute from Section 3.2, for using WebSocket as a transport protocol, is not likely to be used with SDP bundle, and it's categorized as CAUTION for multiplexing 💀.

If future extensions define how to bundle WebSocket, then the multiplexing rules for the "a=websocket-uri" attribute will need to be defined too. For example, that could happen in an extension of this SDP-based WebSocket negotiation spec 👑.

4. SDP Offer/Answer Procedures 💌

4.1. General 🌈

An endpoint (that is, both the offerer and the answerer) that wants to negotiate WebSocket as its transport protocol MUST indicate that it wants to use WebSocket or secure WebSocket in the "proto" field of the "m=" line 💖. The server side, which could be either the offerer or the answerer, MUST also add an "a=websocket-uri" attribute to the media section. Its value can be either a "ws-URI" or a "wss-URI", as defined in Section 3 of [RFC6455], depending on whether the server wants to use WebSocket or secure WebSocket 🔐. This new attribute MUST follow the syntax defined in Section 3. The procedures in this section apply to an "m=" line associated with any media stream that uses WebSocket or secure WebSocket as its transport 🎯.

Either the offerer or the answerer can start a WebSocket connection ⭐. Based on the topology (for example, if the client is behind NAT and the server has a global IP address), the offerer and answerer apps are expected to decide together who starts the WebSocket connection, and then set the "setup" attribute in SDP appropriately, following the procedures of [RFC4145] 🧚‍♀️.

4.2. Generating the Initial Offer 🍓

To negotiate WebSocket as a transport, an SDP offerer MUST indicate that it wants to use it in the "proto" field of the "m=" line 💜. For example, to negotiate BFCP-over-WebSocket, the "proto" value in the "m=" line is TCP/WSS/BFCP if WebSocket is over TLS. Otherwise, it's TCP/WS/BFCP, as specified in [BFCP-WEBSOCKET] 🦋.

The offerer SHOULD set the SDP "setup" attribute to "active" (meaning the offerer will start the outgoing TCP connection), or to "passive" if the offerer wants to be the receiver of an incoming connection 🌸. The offerer MUST NOT assign an SDP "setup" attribute with a "holdconn" value 🙅‍♀️. The offerer MUST follow the procedures described in [RFC4145] while using the "setup" attribute 📜. If the "setup" attribute has the value "passive", then it MUST have a URI in the "a=websocket-uri" attribute 🔗.

Here's an example of an "m=" line for a BFCP connection 🎀:

Offer (browser):
m=application 9 TCP/WSS/BFCP *
a=setup:active
a=connection:new
a=floorctrl:c-only
m=audio 55000 RTP/AVP 0
m=video 55002 RTP/AVP 31

In the example above, the client plans to set up the TLS/TCP connection, so the port is set to 9, which is the discard port 🗑️✨.

4.3. Generating the Answer ✨

Okay so, if the answerer says yes to the offered WebSocket transport connection, the answerer MUST assign an SDP "setup" attribute with a value of either "active" or "passive", following the procedures in [RFC4145]. 🎀 The answerer MUST NOT assign an SDP "setup" attribute with a value of "holdconn". Not that one, bestie. 🙅‍♀️

If the answerer picks "active", the answerer MUST initiate the WebSocket connection handshake by acting as client on the negotiated media stream, heading toward the URI in the a=websocket-uri SDP attribute. It does this using the procedures in Section 4 of [RFC6455]. 🦋

If the answerer picks "passive", then it MUST have a value of ws-URI or wss-URI in an a=websocket-uri SDP attribute, as defined in Section 3 of [RFC6455]. Which one depends on whether the app uses WebSocket or secure WebSocket. 🔐 This attribute MUST follow the syntax defined in Section 3. The syntax is the main character here. 👑

Here's an example where the server answers with a BFCP media stream running over a WebSocket connection that uses TLS. It shows the answer m= line for the BFCP connection. Since WebSocket is running over TLS in this example, the server replies with an a=websocket-uri attribute in the media section, using a wss-URI connection URI. Iconic. 💜

Answer (server):
m=application 50000 TCP/WSS/BFCP *
a=setup:passive
a=connection:new
a=websocket-uri:wss://bfcp-ws.example.com?token=3170449312
a=floorctrl:s-only
a=confid:4321
a=userid:1234
a=floorid:1 m-stream:10
a=floorid:2 m-stream:11
m=audio 50002 RTP/AVP 0
a=label:10
m=video 50004 RTP/AVP 31
a=label:11

4.4. Offerer Processing of the Answer 🌸

When the offerer gets an SDP answer, and the offerer ends up being the one who initiates the TCP connection, then it MUST follow the procedures in Section 5. No skipping ahead, babe. 💅

4.5. Modifying the Session 🌈

Once an offer/answer exchange is done, either endpoint MAY send a new offer to change the session. Plot twist: the endpoints can reuse the existing WebSocket connection by adding an a=connection:existing attribute to the media section of the SDP, following the rules in [RFC4145]. They can do this if the websocket-uri SDP value and the transport parameters that each endpoint indicated haven't changed. ✨ If something did change, they go back to the rules for the initial offer/answer exchange. Then they can negotiate and create a brand new WebSocket connection on top of TLS/TCP or TCP. Fresh start, it's giving reinvention. 🧚

4.6. Offerless INVITE Scenarios 📞

Sometimes an endpoint (like a browser) that's starting the call, which is a User Agent Client or UAC, can send an offerless INVITE to the server. The server is the one that generates the offer in response to the INVITE. 🙈 In that case, the server MUST send an offer with the "setup" attribute set to "passive", so it can accept incoming connections. It MUST also include an a=websocket-uri attribute in the media section. That value MUST be either ws-URI or wss-URI, depending on whether the server wants to use WebSocket or secure WebSocket. The SDP offer the server sends will look like the example in Section 4.3. Same energy, different entrance. 🎀

5. Procedures at WebSocket Client 💖

The WebSocket client MUST always initiate the outgoing TCP connection. So the SDP "setup" attribute MUST always be "active" for the WebSocket client in its SDP offer/answer. In the example below, the WebSocket client is the offerer, which is why it assigns a "setup" attribute with a value of "active". Simple, clean, no drama. 🫶

The WebSocket server is a server on the Internet. So it MUST always assign an SDP "setup" attribute with a value of "passive". This also means there's no need to use Interactive Connectivity Establishment (ICE) between the WebSocket client and the WebSocket server, because the connection model here is a typical client-to-server web connection. 🌐 Less work, more slay.

Once the offer/answer is complete, the client MUST initiate the WebSocket connection handshake. It does this by sending a GET message on the negotiated media stream, heading toward the URI in an a=websocket-uri attribute, following the procedures in [RFC6455]. If no port is passed in the a=websocket-uri attribute, the default port is used. That's port 80 or 443, depending on whether the value was ws-URI or wss-URI. 🔥

6. Security Considerations 😭🔒

Okay, this section is serious, bestie. An attacker might try to add, modify, or remove an a=websocket-uri attribute from a session description. 💀 That could make an application behave in ways nobody wants. So it is RECOMMENDED that integrity protection be applied to the SDP session descriptions. For session descriptions carried in SIP [RFC3261], S/MIME is available to provide that end-to-end integrity protection. Lock it down. 🔐

As described in Section 10 of [RFC6455], application signalling traffic that's transported over WebSocket MUST support secure WebSocket. It SHOULD employ secure WebSocket when communicating with its peers. Non-negotiable, honestly. ⭐

The WebSocket clients have to initiate the TCP connection to the WebSocket server. That server is identified by the Fully Qualified Domain Name (FQDN) in an a=websocket-uri attribute. And just like with any other web connection, the clients will verify the server's certificate. 🧐 On top of that, the WebSocket client MUST follow the procedures in [RFC7525], including host name verification as per Section 6.1 in [RFC7525], while setting up a TLS connection with a WebSocket server. Verify everything, trust nothing, periodt. 👑

7. IANA Considerations 🌷

7.1. Registration of the "websocket-uri" SDP Media Attribute 🦋

This document defines a new SDP media-level attribute called "websocket-uri" in Section 3.2. IANA has registered the following SDP att-field under the "Session Description Protocol (SDP) Parameters" registry, like this:

+---------------------+---------------------------------------------+
| Attribute name:     | websocket-uri                               |
| Long-form attribute | WebSocket Connection URI                    |
| name:               |                                             |
| Type of attribute:  | media                                       |
| Mux category:       | CAUTION                                     |
| Charset Dependent:  | No                                          |
| Purpose:            | The "websocket-uri" attribute is intended   |
|                     | to be used as a connection URI for opening  |
|                     | the WebSocket connection.                   |
| Appropriate values: | A ws-URI  or wss-URI, as defined in Section |
|                     | 3 of [RFC6455]                              |
| Contact name:       | Gonzalo Salgueiro                           |
| Contact email:      | gsalguei@cisco.com                          |
| Reference:          | RFC 8124                                    |
+---------------------+---------------------------------------------+

8. References 📚

8.1. Normative References 💜

[RFC2119]  Bradner, S., "Key words for use in RFCs to Indicate
           Requirement Levels", BCP 14, RFC 2119,
           DOI 10.17487/RFC2119, March 1997,
           <http://www.rfc-editor.org/info/rfc2119>.

[RFC4145]  Yon, D. and G. Camarillo, "TCP-Based Media Transport in
           the Session Description Protocol (SDP)", RFC 4145,
           DOI 10.17487/RFC4145, September 2005,
           <http://www.rfc-editor.org/info/rfc4145>.

[RFC6455]  Fette, I. and A. Melnikov, "The WebSocket Protocol",
           RFC 6455, DOI 10.17487/RFC6455, December 2011,
           <http://www.rfc-editor.org/info/rfc6455>.

8.2. Informative References 🧠

[BFCP]     Camarillo, G., Drage, K., Kristensen, T., Ott, J., and C.
           Eckel, "The Binary Floor Control Protocol (BFCP)", Work in
           Progress, draft-ietf-bfcpbis-rfc4582bis-16, November 2015.

[BFCP-WEBSOCKET]
           Pascual, V., Roman, A., Cazeaux, S., Salgueiro, G., and R.
           R, "The WebSocket Protocol as a Transport for the Binary
           Floor Control Protocol (BFCP)", Work in Progress,
           draft-ietf-bfcpbis-bfcp-websocket-15, February 2017.

[RFC3261]  Rosenberg, J., Schulzrinne, H., Camarillo, G., Johnston,
           A., Peterson, J., Sparks, R., Handley, M., and E.
           Schooler, "SIP: Session Initiation Protocol", RFC 3261,
           DOI 10.17487/RFC3261, June 2002,
           <http://www.rfc-editor.org/info/rfc3261>.

[RFC3264]  Rosenberg, J. and H. Schulzrinne, "An Offer/Answer Model
           with Session Description Protocol (SDP)", RFC 3264,
           DOI 10.17487/RFC3264, June 2002,
           <http://www.rfc-editor.org/info/rfc3264>.

[RFC4566]  Handley, M., Jacobson, V., and C. Perkins, "SDP: Session
           Description Protocol", RFC 4566, DOI 10.17487/RFC4566,
           July 2006, <http://www.rfc-editor.org/info/rfc4566>.

[RFC5246]  Dierks, T. and E. Rescorla, "The Transport Layer Security
           (TLS) Protocol Version 1.2", RFC 5246,
           DOI 10.17487/RFC5246, August 2008,
           <http://www.rfc-editor.org/info/rfc5246>.

[RFC7118]  Baz Castillo, I., Millan Villegas, J., and V. Pascual,
           "The WebSocket Protocol as a Transport for the Session
           Initiation Protocol (SIP)", RFC 7118,
           DOI 10.17487/RFC7118, January 2014,
           <http://www.rfc-editor.org/info/rfc7118>.

[RFC7230]  Fielding, R., Ed. and J. Reschke, Ed., "Hypertext Transfer
           Protocol (HTTP/1.1): Message Syntax and Routing",
           RFC 7230, DOI 10.17487/RFC7230, June 2014,
           <http://www.rfc-editor.org/info/rfc7230>.

[RFC7395]  Stout, L., Ed., Moffitt, J., and E. Cestari, "An
           Extensible Messaging and Presence Protocol (XMPP)
           Subprotocol for WebSocket", RFC 7395,
           DOI 10.17487/RFC7395, October 2014,
           <http://www.rfc-editor.org/info/rfc7395>.

[RFC7525]  Sheffer, Y., Holz, R., and P. Saint-Andre,
           "Recommendations for Secure Use of Transport Layer
           Security (TLS) and Datagram Transport Layer Security
           (DTLS)", BCP 195, RFC 7525, DOI 10.17487/RFC7525, May
           2015, <http://www.rfc-editor.org/info/rfc7525>.

[RFC7977]  Dunkley, P., Llewellyn, G., Pascual, V., Salgueiro, G.,
           and R. Ravindranath, "The WebSocket Protocol as a
           Transport for the Message Session Relay Protocol (MSRP)",
           RFC 7977, DOI 10.17487/RFC7977, September 2016,
           <http://www.rfc-editor.org/info/rfc7977>.

[SDP-MUX]  Nandakumar, S., "A Framework for SDP Attributes when
           Multiplexing", Work in Progress, draft-ietf-mmusic-sdp-
           mux-attributes-16, December 2016.

[WS-API]   Hickson, I., Ed., "The WebSocket API", W3C
           Candidate Recommendation, September 2012,
           <https://www.w3.org/TR/2012/CR-websockets-20120920/>.

Acknowledgements 🫶🌟

Thanks to Christer Holmberg for raising the need for a BFCP-independent SDP attribute for WebSocket Connection URI. Huge shoutout. 💖

The authors wish to acknowledge Paul Kyzivat, Suhas Nandakumar, Christer Holmberg, Charles Eckel, Dan Wing, Alissa Cooper, and Joel Halpern for their invaluable suggestions and review comments. Iconic squad. 👑

Thanks to Mirja Kuehlewind, Alexey Melnikov, Ben Campbell, and Kathleen Moriarty for their comments and feedback during IESG reviews. You all ate this. 🍓

Authors' Addresses ✨

okay bestie, here are the humans who wrote this one 🫶 these are the people to thank (or politely email) about it 💌

Ram Mohan Ravindranath 🌸

Ram Mohan Ravindranath
Cisco Systems, Inc.
Cessna Business Park,
Kadabeesanahalli Village, Varthur Hobli,
Sarjapur-Marathahalli Outer Ring Road
Bangalore, Karnataka  560103
India

Email: rmohanr@cisco.com

Gonzalo Salgueiro 🦋

Gonzalo Salgueiro
Cisco Systems, Inc.
7200-12 Kit Creek Road
Research Triangle Park, NC  27709
United States of America

Email: gsalguei@cisco.com

and that's the whole RFC, periodt 💅👑

📦 where this page comes from

ietf: rfc8124 2017-03
💖 girlified by claude-haiku-5-5 on 2026-10-18: a language model's rewrite of the original, under its terms