VEMMI URL Specification
Extracted elements (24)
HTTP (with Connection: keep-alive or the Upgrade header for protocol switching to vemmi) is identified as a possible transport for VEMMI objects and session data, but this use is explicitly out of scope for this document, reflecting VEMMI's complementary relationship to HTTP/HTML.
Service, username, and password are exchanged via a telnet/videotex-compatible text dialog (prompted by the server) rather than embedded in the URL, because the VEMMI terminal is in 'standard' (telnet/videotex) mode before the VEMMI session starts and the URL credential prohibition prevents embedding credentials.
The parameter syntax requires each value to be labeled by an attribute (attribute=value), differing from the params syntax in RFC 1808, in order to allow unambiguous identification and transmission of additional data such as $USERDATA to the VEMMI service.
The URL mechanism was chosen for VEMMI service selection because a VEMMI server may host multiple simultaneous applications, and the URL fully describes which service to activate. It also enables Web browsers to launch VEMMI client modules for vemmi:// links in HTML documents.
VEMMI is designed to be fully platform independent, and VEMMI objects and content can interoperate between any platform. The only exception is operative objects, which may be binary programs specific to a given hardware platform and OS.
VEMMI URL support may be integrated into browsers via the WWW_RegisterProtocol API or an associated plug-in. The application/vemmi MIME type in the HTTP Accept header can be used to detect VEMMI browser support server-side.
Web browsers encountering a VEMMI URL without VEMMI support may either signal an unrecognized scheme error or misinterpret the URL as a relative URL. Mitigation strategies include HTTPD-level detection and offering fallback download links for VEMMI client software.
Client answers during service selection MUST always be followed by a Carriage Return (CR). If a Line Feed (LF) is transmitted after the CR, it will be ignored by the server.
For security reasons, the username and password MUST NOT be specified in the VEMMI URL.
It is RECOMMENDED that, when possible, the HTTP status code syntax be used for host responses during error or normal operation to facilitate automatic processing by the client.
It is STRONGLY RECOMMENDED that users disable the option of running operative objects in their VEMMI software when receiving potentially unsafe VEMMI objects, or at least enable user-approval prompting before execution.
The VEMMI client MUST be ready to start the VEMMI session as soon as it receives the VEMMI_Open command from the server.
Optional parameters (attribute/value pairs) separated by semicolons may follow the <vemmiservice> in the URL. Reserved attribute names beginning with '$' include $COMMAND, $CONTEXTDATA, $OBJECT_REQUEST, and $USERDATA.
The application/vemmi MIME type requires no mandatory parameters. The optional 'version' parameter is formatted as version=<integer>, where the first digit represents the major VEMMI version number.
The MIME media type application/vemmi is defined for transport of VEMMI objects outside a continuous session (e.g., via HTTP or email). An optional 'version' parameter carries a numeric integer encoding the VEMMI version as defined in ETS 300 709.
The preferred encoding for application/vemmi content is base64 because VEMMI uses a native 8-bit binary file format. However, VEMMI data may also be transmitted in 7-bit mode using VEMMI's own 7-bit encoding mechanisms.
The 'vemmi' URL scheme designates multimedia interactive services conforming to the VEMMI standard (ITU-T T.107 and ETSI ETS 300 709). It takes the form vemmi://<host>:<port>/<vemmiservice>;<attribute>=<value>, where the port defaults to 575 and the vemmiservice component is optional.
The <vemmiservice> field in the URL identifies the VEMMI application to activate on the remote host. It is optional; if omitted and the server requires it, the VEMMI client software must prompt the user.
The well-known TCP port assigned by IANA to the VEMMI protocol is 575. Client software may choose to ignore an optional port number in the URL to increase security.
The username/password identification scheme used during VEMMI service selection is insecure and provided for backwards compatibility only. VEMMI services requiring safe identification must rely on alternative mechanisms such as S/KEY.
The VEMMI URL scheme is subject to the same security implications as the general URL scheme (RFC 1738), including the prohibition on storing credentials in URLs and the general URL security precautions.
VEMMI operative objects are executable programs downloaded and run on the client platform. They pose a risk of harmful execution; users should configure VEMMI software to disable or require approval before running operative objects.
Before a VEMMI session begins, a terminal is in 'standard' mode (videotex or telnet window). The server may prompt for 'service:', 'username:', and 'password:'; the client answers each. The VEMMI session starts when the client receives the VEMMI_Open command from the server.
The BNF grammar for the VEMMI URL defines: vemmiurl = 'vemmi://' hostport [ '/' vemmiservice *[ parameter ] ]; parameter = ';' attribute '=' value. Attribute names are case-insensitive; values may or may not be case-sensitive depending on the attribute.