Re: [Webpush] Stephen Farrell's Discuss on draft-ietf-webpush-protocol-11: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

On 17/10/16 08:03, Brian Raymor wrote:
> Correcting a mail bounce. Apologies for duplicates.
> 
> Take two.
> 
>> So what's not clear to me is how webpush works with the SOP
>> and whether there's anything more that needs to be said about
>> that in the document. For example, you sensibly recommend
>> running the push service on port 1001 but none of the examples
>> mention that port in the Host or :authority values shown.
>> This may all be clear to someone who's very familiar with
>> alt-svc though, (but it wasn't clear to me:-), which might
>> be fine, but I'm not sure. As an example, is the application
>> that is pushing the messages required to know that the
>> push service is or is not using port 1001?
> 
> I've added a clarification to Section 1.1 regarding the examples in the
> document - outlining the minor changes required if Alt-Svc was in play:
> 
> https://github.com/webpush-wg/webpush-protocol/pull/141/files
> 
> The small difference is the inclusion of the Alt-Used header field in the user agent 
> requests to the push service. No other changes (such as URLs) are required which 
> matches the description in RFC7838: '...  in general, they are not visible to
> the software "above" the access mechanism. ' The "routing" is transparently
> managed in the HTTP stack based on my understanding. 
> 
> Similarly, the application server is NOT required to know that the push service and
> user agent are using port 1001. 


Thanks. I think I've tracked down the source of my confusion
which isn't quite the above (though that does seem like an
improvement).

In section 3 it says:

  "The push service shares the same
   default port number (443/TCP) with HTTPS, but MAY also advertise the
   IANA allocated TCP System Port 1001 using HTTP alternative services
   [RFC7838]."

I think the MAY there is what got me into a confused state.
Say if a UA knows to use port 1001 on example.net and just
goes there, then the UA will treat the content as having the
origin example.net:1001. If however the UA goes to example.net
on port 443 first and then sees an alt-svc, then when it goes
to port 1001 it'll treat the content as having origin just
example.net. I guess that'll make a difference in how the UA
handles pushed content.

And I think what's different here, compared to a generic
use of alt-svc, is that port 1001 is being registered so
it's more likely a UA goes directly there the very first
time and never hits 443.

Seems to me that may mean there's a missing bit of text
warning of that, and perhaps a missing bit of text that
push services would be wise to advertise the port 443 URLs
to which a UA can subscribe and then use alt-svc to schlep
UAs over to port 1001. (And maybe that means that the
text about "advertising the alternate port (1001)"
could also do with a change?)

Does the above sound right? Or am I still confused? :-)

Cheers,
S.



> 
> ...Brian
>