skip a Session Establishment request

[soulfly]

I found one thing which we can actually omit:

If your server is new enough (so implements RFC 6121 correctly), you can skip a roundtrip by skipping the urn:ietf:params:xml:ns:xmpp-session IQ.
See https://datatracker.ietf.org/doc/draft-cridland-xmpp-session/?include_text=1.

The Extensible Messaging and Presence Protocol (XMPP) historically had a Session Establishment request defined in RFC 3921 which clients were required to perform at the beginning of a session. RFC 6121 dropped this entirely. This specification reinstates it as an optional no-op to aid backwards compability, matching commonly deployed workarounds.

and this is also mentioned here https://tools.ietf.org/html/rfc6121#page-112

Can we skip this step with Strophejs?

[jcbrand]

Best thing you can do to move this forward is to make a pull request.

[soulfly]

Looks like the right way is to support 'optional' element
https://tools.ietf.org/html/draft-cridland-xmpp-session-01#section-2.1

so if server returns 'optional' then the strophejs lib should skip this request.

[rj33]

I can confirm that skipping this step works fine on ejabber since at least ejabberd 16.09. I have this code in place:

if (!Strophe.avoidAuthSession && this.do_session) {
                    this._addSysHandler(this._sasl_session_cb.bind(this),
                                        null, null, null, "_session_auth_2");
                  this.send($iq({type: "set", id: "_session_auth_2"})
                                  .c('session', {xmlns: Strophe.NS.SESSION})
                                  .tree());
                } else {
                    this.authenticated = true;
                    this._changeConnectStatus(Strophe.Status.CONNECTED, null);
                }

Where the avoidAuthSession is something I set to true when I know I'm going to be pointing at a new ejabberd. It is probably worth implementing the suggestion by @soulfly and properly checking if this step is optional so everyone can benefit from the skipped step. It leads to a noticeable improvement in connection setup time for clients a long way from the server where an extra round trip can be significant. This is especially handy on websockets where session attachment can't easily be done (previously when using BOSH I avoided the auth round trip costs by pre-authenticating on the server side and then allowing the client to do a much faster session attachment afterwards).

[jcbrand]

Looks like session establishment is still required by im.wordpress.com, so we shouldn't drop it entirely. Checking for optional makes sense.

See xmppjs/xmpp.js#454