<abstract>This specification provides historical documentation regarding the "alternative script syntax" first defined in Version 1.6 of XEP-0124.</abstract>
<remark><p>Initial published version.</p></remark>
</revision>
<revision>
<version>0.0.1</version>
<date>2008-08-14</date>
<initials>ip</initials>
<remark><p>Extracted from XEP-0124 version 1.6.</p></remark>
</revision>
</header>
<section1topic='Introduction'anchor='intro'>
<p>The cross domain security restrictions of some runtime environments permit clients to access pure XML text only if it was received from a specific server (e.g., the hostname a Web client was downloaded from). Surprisingly, the same environments typically permit clients to receive and execute scripts from any server. The <linkurl="#security">Security Considerations</link> section below describes the significant risks of deploying Script Syntax.</p>
<p>To enable domain-restricted clients to use BOSH with any connection manager, this section proposes an <em>optional</em> alternative to the standard "BOSH Pure Syntax" defined in &xep0124;. The "BOSH Script Syntax" defined here essentially inserts each <body/> element sent by the client into an HTTP GET header instead of into the body of a POST request. Each <body/> element sent by the connection manager is wrapped inside an &ecma262; string and function call. No changes to the <body/> element or to any other aspects of the BOSH protocol are needed.</p>
<p>If, and only if, a client is <em>unable</em> to use the Pure Syntax defined in <cite>XEP-0124</cite>, then it MAY instead request the use of the Script Syntax defined herein.</p>
</section1>
<section1topic='Script Syntax'anchor='syntax'>
<section2topic='Requesting Use of Script Syntax'anchor='syntax-request'>
<p>A BOSH client can send a session request to a BOSH connection manager for using Script Syntax instead of Pure Syntax.</p>
<p>If the connection manager supports Script Syntax then it MUST send its Session Creation Response using Script Syntax, and all subsequent client requests and connection manager responses within the session MUST be sent using Script Syntax. If the connection manager does not support the "BOSH Script" syntax then it SHOULD return either an 'item-not-found' terminal binding error (in Script Syntax) or an HTTP 404 (Not Found) error in response to the client's session request.</p>
<p>Note: The line break in the body of the HTTP response in the following example is included only to improve readability. In practice there MUST be no line breaks.</p>
<examplecaption="Script Syntax not supported binding error">
<examplecaption="Script Syntax not supported HTTP error">
<![CDATA[HTTP/1.1 404 Not Found
Content-Length: 0]]></example>
</section2>
<section2topic='Changes to the Request Syntax'anchor='script-request'>
<p>Clients MUST make the following changes to convert their requests to Script Syntax:</p>
<ol>
<li><p>Certain octets within the UTF-8 encoded <body/> element SHOULD be replaced according to the rules for escaping octets within URIs defined by &rfc3986;. Therefore all octets except those representing 7-bit alphanumeric characters or the characters -._~!$&'()*+,;=:@/? should be substituted with a character triplet, consisting of the percent character "%" followed by the two hexadecimal digits that represent the value of the octet.</p></li>
<li><p>A '?' character and the URI-encoded <body/> element MUST be appended to the URI at which the connection manager is operating within its server.</p></li>
<li><p>The resulting URI MUST be sent to the connection manager within an HTTP GET request.</p></li>
<li><p>Include extra HTTP headers to prevent request/response caching or storage by any intermediary.</p></li>
</ol>
<p>Note: All whitespace between "GET " and " HTTP/1.1" in the HTTP GET header lines in the following two examples is included only to improve readability. In practice there MUST be no whitespace.</p>
<examplecaption="Requesting a BOSH session in Script Syntax"><