Programming Jabber

The <key/> tag

The <key/> tag is used in registration and search sequences to add a simple form of security between the service and the entity requesting the service. It enables the service, the responder, to verify that the requester from whom it has just received an IQ-set is the same requester that had sent an IQ-get earlier.

This security mechanism predates the server-to-server dialback mechanism, described in Chapter 4. Since the advent of dialback, the relevance of the <key/> tag usage has been reduced.

If a component wants to determine who ought to be allowed to partake of its registration or search services, it would make sense to make the determination when responding to an initial IQ-get, the “can I do this, and what do I have to do?” request. If the request is to be denied, the component can send back an IQ-error, say, with an error 405 “Not Allowed” (see Table 5-3).

If, however, the component determines that the requester should be allowed to use the service (with an IQ-set), it can send back an IQ-result containing a <key/> tag along with the rest of the instructions and fields. The <key/> tag contains a random string, such as a message digest of the requester’s JID combined with a secret phrase. When the requester is ready to make the IQ-set, the “OK, I’d like to use this service, and here’s the data” request, the <key/> tag must be included, with the contents intact. On receipt of the IQ-set, the component doesn’t have to determine whether the requester is allowed ...