&xep0166; defines a framework for negotiating and managing out-of-band data sessions over XMPP. In order to provide a flexible framework, the base Jingle specification defines neither data transport methods nor application formats, leaving that up to separate specifications.

The current document defines two transport methods for establishing and managing data exchanges between XMPP entities using the Hyper Text Transfer Protocol (HTTP, see &rfc2616;); one method is for sharing via pulling data from an HTTP URI (http-download), and the other is for sharing via pushing data to an HTTP URI (http-upload).

Historically, &xep0066; has been used to trigger downloading files via HTTP, as well as initiating the use of any other known URI scheme. However, it has several limitations:

• It only allows for the downloading of files via HTTP, not uploading.
• It can not specify any additional headers that might be necessary for downloading files (authentication tokens, etc).
• The allowance of any URI scheme makes it too unwieldy to be integrated into Jingle the way SOCKS5 Bytestreams and In-Band Bytestreams were (see &xep0260; and &xep0261;).

As such, this document defines two Jingle mechanisms designed to meet the following requirements:

• Allow for both uploading and downloading of data via HTTP.
• Allow additional HTTP headers to be specified.
• Restrict the URI scheme to HTTP/HTTPS.

In accordance with Section 12 of XEP-0166, this document specifies the following information related to both the Jingle http-download and http-upload transport methods:

1. The transport negotiation process for http-download is defined in the Negotiating HTTP Download section of this document, and the negotation process for http-upload is defined in the Negotiating HTTP Upload section of this document.

2. The semantics of the &TRANSPORT; element are defined in the Negotiating HTTP Download and Negotiating HTTP Upload sections of this document.

3. Successful negotiation of both the http-download and http-upload methods results in use of a streaming transport method suitable for use in Jingle application types where packet loss cannot be tolerated (e.g., file transfer).

4. Multiple components are not supported by http-download or http-upload.

Negotiating HTTP downloads is done by using a &TRANSPORT; element with the 'urn:xmpp:jingle:transports:http:0' namespace, &VNOTE;. This element MAY include <candidate/> elements which represent URIs where data can be downloaded. Each <candidate/> element MUST include a 'uri' attribute, and MAY contain <header/> elements whose 'name' attribute is an HTTP header and whose text content is the HTTP header value.

Multiple candidates MAY be provided, indicating that there are multiple URIs from which the data can be retrieved (e.g. multiple candidates could be included to list the primary URI of a file along with several known mirrors).

The generation of candidates is based on the Jingle content senders, and only the parties specified to send data SHOULD provide candidates.

Upon receiving an HTTP download candidate, parties that are to receive data (based on the Jingle content senders) SHOULD use an HTTP GET request to the candidate URI to fetch the data.

Entities MAY initially provide an empty set of candidates if a suitable download URI is not yet known; advertising candidates later is done with transport-info actions.

Negotiating HTTP uploads is done by using a &TRANSPORT; element with the 'urn:xmpp:jingle:transports:http:upload:0' namespace, &VNOTE;. This element MAY include a <candidate/> element which represents a URI where data can be uploaded. The <candidate/> element MUST include a 'uri' attribute, and MAY contain <header/> elements whose 'name' attribute is an HTTP header and whose text content is the HTTP header value.

The generation of candidates is based on the Jingle content senders, and only the parties specified to receive data SHOULD provide candidates.

Upon receiving an HTTP upload candidate, parties that are to send data (based on the Jingle content senders) SHOULD use an HTTP PUT request to the candidate URI, where the request body is the data to be transferred.

See Upload Complete for signaling that the upload process has been completed.

To advertise its support for the Jingle HTTP Transport Method, when replying to &xep0030; information requests an entity MUST return URNs for any version of this protocol that the entity supports -- e.g., "urn:xmpp:jingle:transports:http:0" for this version &VNOTE;.

In order for an application to determine whether an entity supports this protocol, where possible it SHOULD use the dynamic, presence-based profile of service discovery defined in &xep0115;. However, if an application has not received entity capabilities information from an entity, it SHOULD use explicit service discovery instead.

HTTP URI candidates SHOULD use the "https://" URI scheme instead of "http://", and entities MAY refuse to process URIs that are not "https://".

Certain HTTP headers can cause unintended behaviour, such as using the 'Upgrade' header to trigger a conversion to WebSocket (&rfc6455;).

No interaction with &IANA; is required as a result of this document.