The Session Description Protocol (SDP) WebSocket Connection URI Attribute
Extracted elements (16)
A generic, application-protocol-independent SDP attribute ('websocket-uri') was defined rather than per-protocol attributes (e.g., BFCP-specific), because multiple protocols (SIP, MSRP, XMPP, BFCP) each needed a way to convey a WebSocket connection URI via SDP negotiation.
Requiring the WebSocket server to always use 'setup:passive' (and the client 'setup:active') avoids the need for ICE between WebSocket client and server, since the connection model is a typical client-to-server web connection where the server has a global IP address.
The multiplexing category of 'a=websocket-uri' is CAUTION because bundling WebSocket is technically possible but considered impractical. No multiplexing rules are specified; if future extensions define WebSocket bundling, multiplexing rules for this attribute will need to be defined separately.
An endpoint wishing to negotiate WebSocket as transport MUST indicate WebSocket or secure WebSocket in the 'proto' field of the 'm=' line. The server side (offerer or answerer) MUST add an 'a=websocket-uri' attribute with a ws-URI or wss-URI value in the media section.
An SDP offerer MUST NOT assign the SDP 'setup' attribute a value of 'holdconn' when negotiating WebSocket transport. The offerer MUST follow RFC 4145 procedures for the 'setup' attribute, and if 'setup' is 'passive', MUST include a URI in 'a=websocket-uri'.
Endpoints MAY reuse an existing WebSocket connection when modifying a session by including 'a=connection:existing' in the SDP, provided the 'websocket-uri' value and transport parameters are unchanged. Otherwise, a new WebSocket connection MUST be negotiated.
If the answerer assigns 'setup:active', it MUST initiate the WebSocket connection handshake as client toward the URI in 'a=websocket-uri' per RFC 6455 Section 4. If 'setup:passive', the answerer MUST include a ws-URI or wss-URI in 'a=websocket-uri'.
In offerless INVITE scenarios, the server MUST send an offer with 'setup:passive' and MUST include an 'a=websocket-uri' attribute whose value MUST be either a ws-URI or wss-URI, depending on whether plain or secure WebSocket is used.
Once offer/answer is complete, the client MUST initiate the WebSocket handshake by sending a GET message toward the URI in 'a=websocket-uri' per RFC 6455. When no port is given in the URI, the default port (80 for ws-URI, 443 for wss-URI) is used.
The WebSocket client MUST always initiate the outgoing TCP connection; therefore the SDP 'setup' attribute MUST always be 'active' for the WebSocket client in its SDP offer/answer. The WebSocket server MUST always use 'setup:passive'.
When the 'websocket-uri' attribute is present in an SDP media section, the IP address in the 'c=' line SHALL be ignored and the full URI SHALL be used to open the WebSocket connection. Clients MUST use the URI and ignore both the 'c=' IP address and the 'm=' port.
The 'websocket-uri' SDP media-level attribute carries a ws-URI or wss-URI (as defined in RFC 6455 Section 3) indicating the WebSocket connection endpoint. It can appear in any media section of an SDP. Example: a=websocket-uri:wss://example.com/chat.
IANA registered the 'websocket-uri' SDP media-level attribute under the 'Session Description Protocol (SDP) Parameters' registry. Type: media; Mux category: CAUTION; Charset Dependent: No; appropriate values are ws-URI or wss-URI as defined in RFC 6455 Section 3.
An attacker may add, modify, or remove the 'a=websocket-uri' attribute from an SDP session description, causing undesirable application behavior. It is RECOMMENDED that integrity protection (e.g., S/MIME for SIP-carried SDP) be applied to session descriptions.
Application signalling traffic over WebSocket MUST support secure WebSocket (wss) and SHOULD employ it when communicating with peers, as described in RFC 6455 Section 10.
WebSocket clients MUST follow RFC 7525 procedures (including hostname verification per RFC 7525 Section 6.1) when establishing a TLS connection with a WebSocket server identified by the FQDN in the 'a=websocket-uri' attribute.