public static boolean isInvalidStanzaSentPriorToResourceBinding(final Packet stanza, final ClientSession session)
    {
        // Openfire sets 'authenticated' only after resource binding.
        if (session.getStatus() == Session.Status.AUTHENTICATED) {
            return false;
        }

        // Beware, the 'to' address in the stanza will have been overwritten by the
        final JID intendedRecipient = stanza.getTo();
        final JID serverDomain = new JID(XMPPServer.getInstance().getServerInfo().getXMPPDomain());

        // If there's no 'to' address, then the stanza is implicitly addressed at the user itself.
        if (intendedRecipient == null) {
            return false;
        }

        // TODO: after authentication (but prior to resource binding), it should be possible to verify that the
        // intended recipient's bare JID corresponds with the authorized user. Openfire currently does not have an API
        // that can be used to obtain the authorized username, prior to resource binding.

        if (intendedRecipient.equals(serverDomain)) {
            return false;
        }

        return true;
    }
Determines if a peer that is sending a stanza in violation of RFC 6120, section 7.1:

<blockquote>If, before completing the resource binding step, the client attempts to send an XML
stanza to an entity other than the server itself or the client's account, the server MUST NOT process the
stanza and MUST close the stream with a &lt;not-authorized/&gt; stream error.</blockquote>

When this method returns 'true', the stream should be closed. This method does not close the stream.

@param session The session over which the stanza is sent to Openfire.
@param stanza The stanza that is sent to Openfire.
@return true if the peer is in violation (and the stream should be closed), otherwise false.
@see <a href="https://www.rfc-editor.org/rfc/rfc6120#section-7.1">RFC 6120, section 7.1</a>
@see <a href="https://igniterealtime.atlassian.net/jira/software/c/projects/OF/issues/OF-2565">issue OF-2565</a>
xmppserver/src/main/java/org/jivesoftware/openfire/SessionPacketRouter.java