prosody-hg: plugins/mod_websocket.lua history

mod_websocket: Merge session close handling changes from mod_c2s (bug fixes)

Tue, 11 Mar 2025 18:44:40 +0000

mod_websocket: Merge session close handling changes from mod_c2s (bug fixes)

This should bring some fixes and general robustness that mod_websocket had
missed out on. The duplicated code here is not at all ideal. To prevent this
happening again, we should figure out how to have the common logic in a single
place, while still being able to do the websocket-specific parts that we need.

The main known bug that this fixes is that it's possible for a session to get
into a non-destroyable state. For example, if we try to session:close() a
hibernating session, then session.conn is nil and the function will simply
return without doing anything. In the mod_c2s code we already handle this, and
just destroy the session. But if a hibernating websocket session is never
resumed or becomes non-resumable, it will become immortal!

By merging the fix from mod_c2s, the session should now be correctly
destroyed.

mod_bosh,mod_websocket: Don't load mod_http_altconnect in global context

Sat, 22 Feb 2025 21:45:34 +0100

mod_bosh,mod_websocket: Don't load mod_http_altconnect in global context

It blocked loading on VirtualHosts since it was already loaded globally

Thanks eTaurus

mod_bosh, mod_websocket: Add soft dependency on mod_http_altconnect

Sun, 16 Feb 2025 13:32:59 +0000

mod_bosh, mod_websocket: Add soft dependency on mod_http_altconnect

plugins: Use integer config API with interval specification where sensible

Mon, 17 Jul 2023 01:38:54 +0200

plugins: Use integer config API with interval specification where sensible

Many of these fall into a few categories:
- util.cache size, must be >= 1
- byte or item counts that logically can't be negative
- port numbers that should be in 1..0xffff

plugins: Switch to :get_option_period() for time range options

Sun, 16 Jul 2023 20:49:33 +0200

plugins: Switch to :get_option_period() for time range options

Improves readability ("1 day" vs 86400) and centralizes validation.

plugins: Prefix module imports with prosody namespace

Fri, 24 Mar 2023 13:15:28 +0100

plugins: Prefix module imports with prosody namespace

mod_websocket: Fire pre-session-close event (fixes #1800)

Mon, 20 Feb 2023 18:10:15 +0000

mod_websocket: Fire pre-session-close event (fixes #1800)

This event was added in a7c183bb4e64 and is required to make mod_smacks know
that a session was intentionally closed and shouldn't be hibernated (see
fcea4d9e7502).

Because this was missing from mod_websocket's session.close(), mod_smacks
would always attempt to hibernate websocket sessions even if they closed
cleanly.

That mod_websocket has its own copy of session.close() is something to fix
another day (probably not in the stable branch). So for now this commit makes
the minimal change to get things working again.

Thanks to Damian and the Jitsi team for reporting.

mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731)

Mon, 28 Mar 2022 14:53:24 +0100

mod_http (and dependent modules): Make CORS opt-in by default (fixes #1731)

The same-origin policy enforced by browsers is a security measure that should
only be turned off when it is safe to do so. It is safe to do so in Prosody's
default modules, but people may load third-party modules that are unsafe.

Therefore we have flipped the default, so that modules must explicitly opt in
to having CORS headers added on their requests.

mod_websocket: Only enable host-agnostic HTTP routing when enabled globally

Fri, 04 Feb 2022 17:59:42 +0100

mod_websocket: Only enable host-agnostic HTTP routing when enabled globally

This way the host-agnostic http://*:5280/ handler is not enabled, but
BOSH can still be used with any local VirtualHost

Ref #1712

mod_c2s,etc: Identify stanza object with appropriate function

Sun, 24 Oct 2021 15:17:01 +0200

mod_c2s,etc: Identify stanza object with appropriate function

Better than duck typing, in case anyone ever passes a non-stanza table
with a 'name' field.

mod_bosh,mod_websocket: Make into global-shared modules (...again)

Mon, 21 Jun 2021 22:50:23 +0200

mod_bosh,mod_websocket: Make into global-shared modules (...again)

Global modules aren't quite considered loaded onto hosts, which
causes confusion in some cases. They are also reported in the log as
being served on http://*:5280/foo which is also a bit confusing, and
can't be clicked.

Global modules also have to have their paths configured in the global
section, which could be confusing and unexpected.

This global+shared method should be the best of both worlds.

Merge 0.11->trunk

Thu, 13 May 2021 11:17:13 +0100

Merge 0.11->trunk

mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits

Fri, 07 May 2021 17:03:49 +0100

mod_c2s, mod_s2s, mod_component, mod_bosh, mod_websockets: Set default stanza size limits

c2s/bosh/ws streams will default to 256KB, s2s and components to 512KB.

These values are aligned with ejabberd's default settings, which should reduce
issues related to inconsistent size limits between servers on the XMPP network.

The previous default (10MB) is excessive for any production server, and allows
significant memory usage by even unauthenticated sessions.

mod_websocket: Use mod_http_errors html template #1172

Sun, 21 Feb 2021 06:20:55 +0100

mod_websocket: Use mod_http_errors html template #1172

Same as the prior commit to mod_bosh

mod_websocket: Inherit security status from http request

Thu, 18 Feb 2021 10:05:30 +0100

mod_websocket: Inherit security status from http request

Allows requests considered secure becasue of a proxy header to carry
over to the client session.

mod_bosh does this too.

Merge 0.11->trunk

Tue, 29 Sep 2020 15:30:48 +0100

Merge 0.11->trunk

mod_websocket: Refactor frame validity checking, also check partially-received frames against constraints

Tue, 29 Sep 2020 15:18:32 +0100

mod_websocket: Refactor frame validity checking, also check partially-received frames against constraints

mod_websocket: Continue to process data already in the buffer after an error occurs

Mon, 28 Sep 2020 16:36:12 +0100

mod_websocket: Continue to process data already in the buffer after an error occurs

Previously any error, or even a normal websocket close frame, would return early,
leaving potentially entire frames in the buffer unprocessed and then discarded.

This change stops processing new data, but returns an existing processed data up
to the point of the error/close.

mod_websocket: Enforce stanza size limit and close stream

Thu, 17 Sep 2020 16:42:36 +0100

mod_websocket: Enforce stanza size limit and close stream

mod_websocket: Add separate limit for frame buffer size

Thu, 17 Sep 2020 16:42:14 +0100

mod_websocket: Add separate limit for frame buffer size

mod_websocket: handle full frame buffer and raise stream error

Thu, 17 Sep 2020 16:41:48 +0100

mod_websocket: handle full frame buffer and raise stream error

mod_websocket: Switch partial frame buffering to util.dbuffer

Thu, 17 Sep 2020 13:04:46 +0100

mod_websocket: Switch partial frame buffering to util.dbuffer

This improves performance and enforces stanza size limits earlier
in the pipeline.

mod_bosh, mod_websocket: Add config options to override GET responses

Mon, 20 Apr 2020 11:30:59 +0100

mod_bosh, mod_websocket: Add config options to override GET responses

Merge 0.11->trunk

Fri, 24 Jan 2020 16:57:25 +0000

Merge 0.11->trunk

mod_websocket: Fire event on session creation (thanks Aaron van Meerten)

Fri, 24 Jan 2020 16:21:30 +0000

mod_websocket: Fire event on session creation (thanks Aaron van Meerten)

Fri, 24 Jan 2020 16:21:30 +0000

mod_websocket: Fire event on session creation (thanks Aaron van Meerten)

Merge 0.11->trunk

Thu, 02 Jan 2020 10:52:47 +0100

Merge 0.11->trunk

mod_websocket: Clear mask bit when reflecting ping frames (fixes #1484)

Thu, 02 Jan 2020 10:49:37 +0100

mod_websocket: Clear mask bit when reflecting ping frames (fixes #1484)

mod_websocket: Guard against upgrading to websocket from a HEAD request

Sat, 12 Oct 2019 19:16:43 +0200

mod_websocket: Guard against upgrading to websocket from a HEAD request

plugins: Remove tostring call from logging

Tue, 30 Jul 2019 02:29:36 +0200

plugins: Remove tostring call from logging

Taken care of by loggingmanager now

Mass-rewrite using lua pattern like `tostring%b()`

Merge 0.11->trunk

Sun, 28 Jul 2019 16:43:47 +0200

Merge 0.11->trunk

mod_websocket: Clone stanza before mutating (fixes #1398)

Sat, 20 Jul 2019 04:19:58 +0200

mod_websocket: Clone stanza before mutating (fixes #1398)

Checking for `stanza.attr.xmlns == nil` to determine if the stanza
object is an actual stanza (``, `` or `` in the
`jabber:client` or `jabbber:server` namespace) or some other stream
element.

Since this mutation is not reverted, it may leak to other places and
cause them to mistreat stanzas as stream elements. Especially in cases
like MUC where a single stanza is broadcast to many recipients.

Merge 0.11->trunk

Tue, 22 Jan 2019 10:44:24 +0100

Merge 0.11->trunk

mod_websocket: Log an error if cross_domain_websocket = true is set in a VirtualHost section

Tue, 22 Jan 2019 10:41:00 +0100

mod_websocket: Log an error if cross_domain_websocket = true is set in a VirtualHost section

Merge 0.11->trunk

Sat, 19 Jan 2019 21:35:16 +0100

Merge 0.11->trunk

mod_websocket: Include the value of cross_domain_websocket in debug message

Fri, 18 Jan 2019 18:37:04 +0100

mod_websocket: Include the value of cross_domain_websocket in debug message

mod_bosh, mod_websocket: Remove accidentally included dependency on non-existant module

Sat, 19 Jan 2019 20:03:04 +0100

mod_bosh, mod_websocket: Remove accidentally included dependency on non-existant module

mod_websocket: Drop CORS code in favor of that in mod_http

Thu, 04 Oct 2018 12:24:08 +0200

mod_websocket: Drop CORS code in favor of that in mod_http

Like for mod_bosh, deprecates consider_websocket_secure and depend on
mod_http_crossdomain if it is set.

mod_websocket: Silence the one warning instead of ignoring the entire file

Sun, 30 Sep 2018 17:55:13 +0200

mod_websocket: Silence the one warning instead of ignoring the entire file

mod_websocket: Serve HTTP in global context

Sat, 22 Sep 2018 00:02:16 +0200

mod_websocket: Serve HTTP in global context

Merge 0.10 -> trunk

Wed, 16 May 2018 23:50:08 +0100

Merge 0.10 -> trunk

This commit intentionally drops changes from c2b99fa134b3
and 8da11142fabf which are based on older MUC code.

mod_websocket: Store the request object on the session for use by other modules

Tue, 08 May 2018 07:11:33 +0100

mod_websocket: Store the request object on the session for use by other modules

mod_websocket: Transfer IP address derived by mod_http

Thu, 15 Mar 2018 17:52:11 +0100

mod_websocket: Transfer IP address derived by mod_http

mod_websocket: Convert set to string (syslog sink needs a better fix)

Tue, 16 May 2017 17:52:29 +0200

mod_websocket: Convert set to string (syslog sink needs a better fix)

mod_websocket: Log state of cross domain set after changing it

Mon, 03 Apr 2017 17:14:34 +0200

mod_websocket: Log state of cross domain set after changing it

mod_websocket: Make open_stream method behave like the one from util.xmppstream

Thu, 02 Mar 2017 03:03:25 +0100

mod_websocket: Make open_stream method behave like the one from util.xmppstream

mod_websocket: Include xml:lang attribute on stream (fixes #840)

Thu, 02 Mar 2017 03:03:04 +0100

mod_websocket: Include xml:lang attribute on stream (fixes #840)

mod_websocket: Set connections starttls method to false to prevent mod_tls from offering starttls (fixes #837)

Sat, 25 Feb 2017 02:15:15 +0100

mod_websocket: Set connections starttls method to false to prevent mod_tls from offering starttls (fixes #837)

mod_websocket: Allow per-host cross_domain_websocket, defaulting to the base URL of the current host

Mon, 05 Dec 2016 12:23:51 +0100

mod_websocket: Allow per-host cross_domain_websocket, defaulting to the base URL of the current host

mod_websocket: Add the base URL of each host module is enabled on to 'cross_domain_websocket'

Mon, 05 Dec 2016 12:23:41 +0100

mod_websocket: Add the base URL of each host module is enabled on to 'cross_domain_websocket'

mod_websocket: Verify that the client-sent Origin header matches cross_domain_websocket (fixes #652)

Mon, 05 Dec 2016 12:22:41 +0100

mod_websocket: Verify that the client-sent Origin header matches cross_domain_websocket (fixes #652)

mod_websocket: Use contains_token from util.http for checking if the requested WebSocket sub-protocols include XMPP

Sun, 04 Dec 2016 11:57:26 +0100

mod_websocket: Use contains_token from util.http for checking if the requested WebSocket sub-protocols include XMPP

mod_websocket: Add some debug messages

Sun, 04 Dec 2016 11:52:22 +0100

mod_websocket: Add some debug messages

mod_websocket: Set FIN flag on ping frames (fixes #773)

Fri, 04 Nov 2016 13:28:10 +0100

mod_websocket: Set FIN flag on ping frames (fixes #773)

mod_websocket: Fix read timeout handler (thanks mt)

Wed, 06 Apr 2016 14:44:51 +0200

mod_websocket: Fix read timeout handler (thanks mt)

mod_websocket: Send a ping on read timeout

Wed, 23 Mar 2016 23:21:03 +0100

mod_websocket: Send a ping on read timeout

mod_websocket: Remove warning about unsolicited pong frames "MAY be sent unsolicited" per RFC 6455 (thanks mt)

Wed, 23 Mar 2016 14:31:35 +0100

mod_websocket: Remove warning about unsolicited pong frames "MAY be sent unsolicited" per RFC 6455 (thanks mt)

mod_websocket: Make sure stanza xmlns filter runs late in the chain

Fri, 18 Mar 2016 00:08:33 +0100

mod_websocket: Make sure stanza xmlns filter runs late in the chain

mod_websocket: Silence luacheck warnings

Tue, 06 Oct 2015 15:30:25 +0200

mod_websocket: Silence luacheck warnings

mod_websocket: Import util.timer and session close timeout config option (thanks fairuz)

Tue, 06 Oct 2015 15:27:39 +0200

mod_websocket: Import util.timer and session close timeout config option (thanks fairuz)