I built a fully functional web based aim client on my aim server

AOL Instant Messenger
1

I am hosting a Open-Oscar-Server and currently developing / developed an android app that is compatible with any OSS server. I wanted to give users a web option and boy did I ever.

It only works on my server as it relies heavily on the API.

  • Public Homepage

    • Shows total registered users

    • Shows how many users are currently online

    • Counts unique users rather than duplicate sessions

    • Shows total public chat rooms

    • Dynamically lists all current public chat rooms

    • Shows participant counts for public rooms

    • Public room names are clickable aim:gochat?roomname=... links

    • Automatically refreshes server statistics and room information

  • Account Registration

    • Visitors can create a new Retro Chat/AIM account

    • Screen-name and password registration

    • Password confirmation

    • Basic server-side arithmetic CAPTCHA

    • CAPTCHA automatically regenerates after attempts

    • Hidden honeypot field for additional bot protection

    • Account creation goes through the private Open OSCAR Management API

  • AIM / OSCAR Login

    • Native OSCAR authentication

    • Connects directly to the OSCAR service

    • No OSCAR_DEV_KEY

    • No OSCAR_DEV_ID

    • Password is authenticated through the actual OSCAR protocol

    • Establishes a persistent BOS connection

    • Completes OSCAR family/version negotiation

    • Initializes SSI/feedbag

    • Publishes ClientOnline

    • Properly appears online to other AIM/Retro Chat clients

    • Maintains the OSCAR connection through a background PHP CLI worker

  • Buddy List

    • Displays buddies after login

    • Online/offline presence

    • Uses server/API presence information

    • Preserves screen-name capitalization where available

    • Buddy search/filter

    • Add Buddy dialog

    • Buddy groups

    • Refreshes presence information while logged in

  • Instant Messaging

    • Start an IM by screen name

    • Click buddies to open conversations

    • Multiple conversations can remain open as tabs

    • Incoming messages automatically open a conversation tab

    • Incoming tabs use the sender’s actual screen name

    • Sends messages to other AIM/Retro Chat users

    • Receives native OSCAR ICBM messages

    • Incoming OSCAR 04/07 message parsing

    • Supports ASCII text

    • Supports Latin-1 text

    • Supports UCS-2/UTF-16BE text

    • Outgoing messages are routed through the server’s private Management API

    • Incoming messages arrive through the persistent native OSCAR connection

    • Enter sends a message

    • Shift + Enter inserts a new line

  • Native AIM Chat Rooms

    • Native OSCAR ChatNav support

    • Native OSCAR Chat service support

    • Public AIM chat rooms

    • Private AIM chat rooms

    • Join existing public rooms

    • Create/join private rooms by name

    • Exchange 5 support for public rooms

    • Exchange 4 support for private rooms

    • Dedicated OSCAR connection for joined rooms

    • Send chat-room messages

    • Receive chat-room messages

    • Participant join events

    • Participant leave events

    • Participant roster

    • Leave rooms

    • Room messages use the actual OSCAR Chat protocol rather than pretending the Management API is a chat client

    • Enter sends room messages

    • Shift + Enter creates a new line

  • Chat Room Browser

    • Dedicated Chat Room button

    • Opens a centered room-browser popup

    • Popup currently uses about 50% of the browser width and height

    • Dynamically loads all current public rooms

    • Displays room participant counts

    • Click a public room to join it immediately

    • Refresh button updates the room list

    • Scrollable list when there are many rooms

    • Separate field for creating/joining a new room

    • Automatically determines whether the entered room should use the public/private room path

  • Profiles / User Information

    • User-info lookup

    • Profile retrieval

    • Presence information

    • Screen-name information

    • Profile dialog from within the logged-in client

  • Presence / Status

    • Native OSCAR presence publication

    • Other clients can see the web user online

    • Online state comes from a real authenticated OSCAR session

    • SSI is initialized before presence publication

    • Server session information can also be retrieved through port 8080

  • Private Port-8080 Integration

    • PHP can communicate with the Open OSCAR Management API at 127.0.0.1:8080

    • The visitor’s browser never directly accesses port 8080

    • Registered-user information

    • Active-session information

    • Public-room information

    • Account creation

    • Profile/account lookup

    • Outbound IM injection

    • Administrative operations through the protected dashboard

  • API Dashboard

    • Password protected through PHP & other measures.

    • Independent admin authentication session

    • Supports hashed dashboard passwords

    • CSRF protection

    • Failed-login throttling

    • Searchable API command interface

    • Dynamic parameter/body forms

    • Shows API/server overview information

    • Shows registered users

    • Shows active sessions

    • Shows public rooms

    • Shows server version

    • Dangerous commands are clearly marked

    • Destructive commands require additional confirmation

    • API paths are server-side allowlisted

    • Browser cannot submit arbitrary URLs to the private API

  • API Dashboard Commands

    • User/account listing

    • User creation

    • User deletion

    • Password reset operations

    • Session listing

    • Session disconnection

    • Instant-message operations

    • Public chat-room listing

    • Public chat-room creation

    • Public chat-room deletion

    • Private chat-room operations

    • Directory categories

    • Directory keywords

    • Server-version information

    • Web AIM API-key administration

    • BART/buddy assets

    • Server-side buddy-list/feedbag operations

    • Linked-account operations

    • All Management API operations included in the Open OSCAR API specification used when the dashboard was built

  • Security

    • OSCAR passwords aren’t exposed to the Management API for authentication

    • Port 8080 stays private

    • Management API credentials/operations stay server-side

    • PHP sessions protect logged-in state

    • Separate PHP session protects the API Dashboard

    • CSRF protection on administrative operations

    • CAPTCHA protects public registration

    • Honeypot helps block automated registrations

    • API Dashboard uses a strict endpoint allowlist

    • No requirement to expose the Management API publicly

  • Server/Worker Architecture

    • PHP frontend

    • JavaScript interactive AIM-style client

    • Persistent PHP CLI OSCAR worker

    • Native TCP OSCAR connection

    • Worker session files stored outside the public web directory

    • Configurable worker directory

    • Configurable PHP CLI executable

    • Worker logging for OSCAR debugging

    • OSCAR authentication, BOS, presence, incoming IM, ChatNav, and Chat connections handled independently of normal browser requests

2

Eh man look, site is down.

3

Major AT&T fiber outage, been on site waiting for it to come back up.

4

Back up, moved to Cloud VPS with static domain name.