title: Creating persistent connection between Converse JS and Openfire Server
body: <p>Using </p>
  
  <ul>
  <li><a href="https://conversejs.org/" rel="noreferrer">Converse JS v0.9.5</a> as web frontend for messenger </li>
  <li><a href="http://www.igniterealtime.org/projects/openfire/" rel="noreferrer">Openfire XMPP Server v3.10.2</a> as messenger's backend</li>
  <li>Web application itself is written in PHP. </li>
  </ul>
  
  <p>For now, Openfire and website has separate databases but they are synchronized.</p>
  
  <h1>What I want to achieve is:</h1>
  
  <p>when user signs in to website, Converse JS also must login and create persistent connection with <a href="http://www.igniterealtime.org/projects/openfire/" rel="noreferrer">Openfire XMPP Server</a> during whole user session untlil logs out.</p>
  
  <h1>What I've found</h1>
  
  <p>Googled a lot and researched on both Converse JS and Openfire websites. </p>
  
  <p>Read that, there is <a href="https://conversejs.org/docs/html/configuration.html#prebind" rel="noreferrer">prebind property</a> and <a href="https://conversejs.org/docs/html/setup.html#session-support" rel="noreferrer">Single Session Support</a> for Converse JS which allows to achieve what I want. They also, provide <a href="https://github.com/candy-chat/xmpp-prebind-php" rel="noreferrer">PHP library</a> example for website. </p>
  
  <h1>What I've done</h1>
  
  <p>Initial script for Converse JS looks like that:</p>
  
  <pre><code>converse.initialize({
      bosh_service_url: 'https://bind.example.com',
      keepalive: true,
      jid: 'me@example.com',
      authentication: 'prebind',
      prebind_url: 'http://example.com/api/prebind',
      allow_logout: false
  });
  </code></pre>
  
  <p>As far as I understand whole process goes like below:</p>
  
  <p><a href="https://i.stack.imgur.com/r5AtY.png" rel="noreferrer"><img src="https://i.stack.imgur.com/r5AtY.png" alt="enter image description here"></a></p>
  
  <ol>
  <li>sends jid to prebind_url which is <a href="http://example.com/api/prebind" rel="noreferrer">http://example.com/api/prebind</a> (take a look at configuration properties
  above)</li>
  <li>PHP backend receives jid (which is username). To authenticate in XMPP server password, login must be in plain text format. Converse JS, as far as I know, to keep user logged in messenger, may send request to <a href="http://example.com/api/prebind" rel="noreferrer">http://example.com/api/prebind</a> pretty much everytime when it needs (jid, sid, rid). So, from PHP side plain text authentication is required to be ready everytime. </li>
  <li>PHP backend gets results from XMPP Server (jid, sid, rid) using <a href="https://github.com/candy-chat/xmpp-prebind-php" rel="noreferrer">PHP library</a></li>
  <li>Returns back jid, sid, rid as JSON</li>
  </ol>
  
  <h1>So question is</h1>
  
  <p>Confusion starts in 2nd step: should I save user's XMPP password and login in plain text format in PHP sessions because of XMPP authentication? Or am I getting it wrong and there is more secure way to achieve it?</p>
  
  <p>And in 3rd step, while testing with working username and password getting <code>Invalid challenge response received</code> error. Is there any working library for authenticating from PHP?</p>