prosody-hg: plugins/mod_bosh.lua history

Merge 13.0->trunk

Fri, 17 Apr 2026 14:35:32 +0100

Merge 13.0->trunk

mod_bosh: Apply different stanza size limit before authentication

Fri, 17 Apr 2026 12:07:12 +0200

mod_bosh: Apply different stanza size limit before authentication

This is a bit tricky since each request creates a new stream and we
have to start parsing the stream before we know if it belongs to an
already authenticated session.

mod_bosh: Tweak logging

Sat, 27 Sep 2025 18:26:18 +0200

mod_bosh: Tweak logging

Tries to use logger from session or request for easier correlation.

Why were we even logging the whole there? Inconsistent with
mod_c2s.

mod_bosh: Pass stanzas trough bytes/out filter

Tue, 01 Jul 2025 14:07:55 +0200

mod_bosh: Pass stanzas trough bytes/out filter

For consistency with mod_c2s. Not sure if this makes sense given that
BOSH is different from other methods. E.g. with compression, this would
compress only the stanzas and not the opening and closing body tags
without more work.

mod_bosh: Create sessions via sessionmanager

Tue, 01 Jul 2025 14:07:49 +0200

mod_bosh: Create sessions via sessionmanager

Normalizes things like session.id, .type and other properties set by
sessionmanager and util.session.

Fixes #658

mod_bosh: Move all namespaces to variables at the top

Sun, 22 Jun 2025 21:31:37 +0200

mod_bosh: Move all namespaces to variables at the top

Consistency.

Having `xmlns_bosh` hard-coded wasn't needed after 16c7b510694b

mod_bosh,mod_websocket: Don't load mod_http_altconnect in global context

Sat, 22 Feb 2025 21:45:34 +0100

mod_bosh,mod_websocket: Don't load mod_http_altconnect in global context

It blocked loading on VirtualHosts since it was already loaded globally

Thanks eTaurus

mod_bosh, mod_websocket: Add soft dependency on mod_http_altconnect

Sun, 16 Feb 2025 13:32:59 +0000

mod_bosh, mod_websocket: Add soft dependency on mod_http_altconnect

mod_bosh: Set base_type on session

Sun, 17 Mar 2024 10:10:24 +0000

mod_bosh: Set base_type on session

This fixes a traceback with mod_saslauth. Ideally we move this to util.session
at some point, though.

mod_bosh: Include stream attributes in stream-features event

Sat, 28 Oct 2023 13:15:56 +0100

mod_bosh: Include stream attributes in stream-features event

This matches what mod_c2s does, and fixes a traceback in mod_sasl2_fast when
used with BOSH (that module tries to use event.stream.from).

plugins: Use integer config API with interval specification where sensible

Mon, 17 Jul 2023 01:38:54 +0200

plugins: Use integer config API with interval specification where sensible

Many of these fall into a few categories:
- util.cache size, must be >= 1
- byte or item counts that logically can't be negative
- port numbers that should be in 1..0xffff

plugins: Switch to :get_option_period() for time range options

Sun, 16 Jul 2023 20:49:33 +0200

plugins: Switch to :get_option_period() for time range options

Improves readability ("1 day" vs 86400) and centralizes validation.

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731)

Mon, 28 Mar 2022 14:53:24 +0100

mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731)

The same-origin policy enforced by browsers is a security measure that should
only be turned off when it is safe to do so. It is safe to do so in Prosody's
default modules, but people may load third-party modules that are unsafe.

Therefore we have flipped the default, so that modules must explicitly opt in
to having CORS headers added on their requests.

mod_bosh: Only enable host-agnostic HTTP routing when enabled globally

Fri, 04 Feb 2022 17:52:13 +0100

mod_bosh: Only enable host-agnostic HTTP routing when enabled globally

This way the host-agnostic http://*:5280/ handler is not enabled, but
BOSH can still be used with any local VirtualHost

Ref #1712

mod_c2s,etc: Identify stanza object with appropriate function

Sun, 24 Oct 2021 15:17:01 +0200

mod_c2s,etc: Identify stanza object with appropriate function

Better than duck typing, in case anyone ever passes a non-stanza table
with a 'name' field.

mod_bosh: Fix typo in comment

Sun, 19 Sep 2021 16:28:16 +0200

mod_bosh: Fix typo in comment

mod_bosh,mod_websocket: Make into global-shared modules (...again)

Mon, 21 Jun 2021 22:50:23 +0200

mod_bosh,mod_websocket: Make into global-shared modules (...again)

Global modules aren't quite considered loaded onto hosts, which
causes confusion in some cases. They are also reported in the log as
being served on http://*:5280/foo which is also a bit confusing, and
can't be clicked.

Global modules also have to have their paths configured in the global
section, which could be confusing and unexpected.

This global+shared method should be the best of both worlds.

mod_bosh: Add todo to use util.session to create session object

Thu, 29 Jul 2021 20:04:57 +0200

mod_bosh: Add todo to use util.session to create session object

So that we get single point where shared session properties can be
added. But not now. One day. Maybe. Patches welcome.

Fix various spelling errors (thanks codespell)

Tue, 27 Jul 2021 00:13:18 +0200

Fix various spelling errors (thanks codespell)

Also special thanks to timeless, for wordlessly reminding me to check
for typos.

Merge 0.11->trunk

Thu, 13 May 2021 11:17:13 +0100

Merge 0.11->trunk

mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits

Fri, 07 May 2021 17:03:49 +0100

mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits

c2s/bosh/ws streams will default to 256KB, s2s and components to 512KB.

These values are aligned with ejabberd's default settings, which should reduce
issues related to inconsistent size limits between servers on the XMPP network.

The previous default (10MB) is excessive for any production server, and allows
significant memory usage by even unauthenticated sessions.

mod_bosh: Include warning if endpoint accessed insecurely (#1172)

Sun, 21 Feb 2021 06:18:22 +0100

mod_bosh: Include warning if endpoint accessed insecurely (#1172)

This is to make it obvious if a misconfigured a proxy or the request
really is insecure.

Perhaps it should also check c2s_require_encryption?

mod_bosh: Use message template from mod_http_error

Sun, 21 Feb 2021 06:17:40 +0100

mod_bosh: Use message template from mod_http_error

Looking Good!

And most importantly, consistent.

mod_bosh: Count connection attempts non-VirtualHost as "bad host" (stats)

Sat, 03 Oct 2020 15:09:12 +0200

mod_bosh: Count connection attempts non-VirtualHost as "bad host" (stats)

Merge 0.11->trunk

Sat, 03 Oct 2020 15:07:48 +0200

Merge 0.11->trunk

mod_bosh: Ensure that stream is directed to a VirtualHost (fixes #425)

Sat, 03 Oct 2020 15:03:09 +0200

mod_bosh: Ensure that stream is directed to a VirtualHost (fixes #425)

mod_bosh: Pick out the 'wait' before checking it instead of earlier

Sat, 03 Oct 2020 14:59:11 +0200

mod_bosh: Pick out the 'wait' before checking it instead of earlier

Going to add more host related checks, so to keep the wait variable
closer to the related checks

mod_bosh, mod_websocket: Add config options to override GET responses

Mon, 20 Apr 2020 11:30:59 +0100

mod_bosh, mod_websocket: Add config options to override GET responses

mod_bosh: Abort early if request is missing hostname

Sat, 02 Nov 2019 15:29:13 +0100

mod_bosh: Abort early if request is missing hostname

Prevents traceback from passing nil to nameprep()

plugins: Remove tostring call from logging

Tue, 30 Jul 2019 02:29:36 +0200

plugins: Remove tostring call from logging

Taken care of by loggingmanager now

Mass-rewrite using lua pattern like `tostring%b()`

mod_bosh: Added metrics for active/inactive sessions, new BOSH sessions, BOSH errors, and timeouts (finishes #998)

Fri, 03 May 2019 04:10:31 -0700

mod_bosh: Added metrics for active/inactive sessions, new BOSH sessions, BOSH errors, and timeouts (finishes #998)

mod_bosh, mod_websocket: Remove accidentally included dependency on non-existant module

Sat, 19 Jan 2019 20:03:04 +0100

mod_bosh, mod_websocket: Remove accidentally included dependency on non-existant module

mod_bosh: Drop CORS code in favor of than in mod_http

Thu, 04 Oct 2018 12:23:06 +0200

mod_bosh: Drop CORS code in favor of than in mod_http

This deprecates the cross_domain_bosh setting. As a compat measure, if
it is set, mod_http_crossdomain is loaded.

mod_bosh: Handle missing wait attribute (fixes #1288)

Thu, 10 Jan 2019 13:07:22 +0100

mod_bosh: Handle missing wait attribute (fixes #1288)

250855633092 did not fix this completely.

mod_bosh: Fire stream feature event on hosts (thanks gerald)

Mon, 24 Sep 2018 17:46:51 +0200

mod_bosh: Fire stream feature event on hosts (thanks gerald)

Since the module is now global, this event was also fired in a global
context by default.

mod_bosh: Make BOSH global again!

Sat, 22 Sep 2018 00:01:21 +0200

mod_bosh: Make BOSH global again!

mod_bosh: Add extra debug logging to help with #1134

Tue, 15 May 2018 01:22:35 +0200

mod_bosh: Add extra debug logging to help with #1134

Merge 0.10->trunk

Wed, 30 May 2018 21:40:00 +0100

Merge 0.10->trunk

mod_bosh: Store the normalized hostname on session (fixes #1151)

Wed, 30 May 2018 10:58:19 +0200

mod_bosh: Store the normalized hostname on session (fixes #1151)

mod_bosh: Fix inconsistent whitespace [luacheck]

Tue, 01 May 2018 18:21:57 +0200

mod_bosh: Fix inconsistent whitespace [luacheck]

mod_bosh: Fix for 7be8f649d97d to skip error handling and allow other modules to handle the request

Sun, 29 Apr 2018 22:15:44 +0100

mod_bosh: Fix for 7be8f649d97d to skip error handling and allow other modules to handle the request

mod_bosh: Increase number of stored responses to ensure we always keep responses within the rid window available

Wed, 11 Apr 2018 13:24:37 +0100

mod_bosh: Increase number of stored responses to ensure we always keep responses within the rid window available

mod_bosh: Improve connection robustness with better handling of unexpected rids

Tue, 10 Apr 2018 20:34:29 +0100

mod_bosh: Improve connection robustness with better handling of unexpected rids

mod_bosh: Some additonal comments to improve code readability

Tue, 10 Apr 2018 20:30:20 +0100

mod_bosh: Some additonal comments to improve code readability

mod_bosh: Whitespace

Tue, 10 Apr 2018 20:29:46 +0100

mod_bosh: Whitespace

mod_bosh: Improve logging - parse errors will now log through the session logger if possible

Tue, 10 Apr 2018 20:28:59 +0100

mod_bosh: Improve logging - parse errors will now log through the session logger if possible

mod_bosh: Improve logging on session close (reason may be a table with params)

Tue, 10 Apr 2018 20:25:12 +0100

mod_bosh: Improve logging on session close (reason may be a table with params)

mod_http: Set request.ip on all HTTP requests (moves code out of mod_bosh) (fixes #540)

Thu, 15 Mar 2018 17:22:49 +0100

mod_http: Set request.ip on all HTTP requests (moves code out of mod_bosh) (fixes #540)

mod_bosh: Return implicit 404 instead of the proper BOSH terminate thing

Wed, 27 Dec 2017 01:00:34 +0100

mod_bosh: Return implicit 404 instead of the proper BOSH terminate thing

mod_bosh: Limit stream to current host (fixes #371)

Wed, 13 Dec 2017 15:34:53 +0100

mod_bosh: Limit stream to current host (fixes #371)

mod_bosh: Make into a normal module (fixes #402)

Wed, 13 Dec 2017 15:24:02 +0100

mod_bosh: Make into a normal module (fixes #402)

mod_bosh: Use module API to fire events

Wed, 13 Dec 2017 17:31:31 +0100

mod_bosh: Use module API to fire events

mod_bosh: Use moduleapi logger

Wed, 13 Dec 2017 15:23:29 +0100

mod_bosh: Use moduleapi logger

mod_bosh: Rename variable to avoid name clash [luacheck]

Wed, 13 Dec 2017 15:31:21 +0100

mod_bosh: Rename variable to avoid name clash [luacheck]

mod_bosh: Ignore unused argument [luacheck]

Wed, 13 Dec 2017 15:30:37 +0100

mod_bosh: Ignore unused argument [luacheck]

mod_bosh: Remove unused variable [luacheck]

Wed, 13 Dec 2017 15:30:11 +0100

mod_bosh: Remove unused variable [luacheck]

Merge 0.10 -> trunk

Fri, 28 Jul 2017 23:47:38 +0100

Merge 0.10 -> trunk

mod_bosh: Add ::1 to the default trusted_proxies.

Sun, 16 Jul 2017 19:25:15 +0100

mod_bosh: Add ::1 to the default trusted_proxies.

Merge 0.10->trunk

Thu, 20 Apr 2017 00:41:49 +0200

Merge 0.10->trunk