Re: [Webpush] Some comments on webpush server responses

What I was trying to get at was this: The best policy here is to remove a
subscription that gets a 404.  In all cases.

Trying again isn't going to get you better results the next time.  When -
if - you get a chance to run code in the browser again, you have a chance
at remediation.

On 17 August 2016 at 02:21, Ben Last <benlast@mobify.com> wrote:

> Hi Martin
>
> As you point out, distinguishing between 2 & 3 requires running code on
> the browser. But if the end-user does not return to the website, we can't
> run code and therefore can't make that distinction. We may send many
> messages between visits. We can't run code in the service worker because
> there's no event that can be relied on to fire (since no service workers
> support periodic sync, and background sync doesn't allow for repeated
> events).
>
> As for why we might have an invalid subscription: data may be corrupted,
> we may be subject to attacks that send us random subscription data, and we
> do see subscriptions sent from compromised versions of Chromium that may or
> may not be actually valid. Also, it's probably good design to allow for
> this case.
>
> b
>
>
>
> —
>
> Ben Last, Senior Full Stack Engineer
>
> [image: Mobify]
>
> Mobile Customer Engagement
>
> mobify.com
> <http://www.mobify.com/?utm_source=Email&utm_medium=Email&utm_campaign=email-signature> |
> M 1.604.358.0155 | @benlast <https://twitter.com/@benlast>
>
> Mobify is ranked as a leader in mobile customer engagement. View the
> Report!
> <http://resources.mobify.com/forrester-wave-report-2016.html?utm_source=Email&utm_medium=Email&utm_campaign=email-signature>
>
>
>
> On 15 August 2016 at 18:45, Martin Thomson <martin.thomson@gmail.com>
> wrote:
>
>>
>> On 16 August 2016 at 02:50, Ben Last <benlast@mobify.com> wrote:
>>
>>> It's important for us to be able to distinguish because in case 1 we
>>> should remove the subscription, in case 2 we should mark it as blocked (so
>>> that website code does not invite the user to resubscribe) and in case 3 we
>>> should mark the subscription so that a service worker or website code
>>> resubscribes.
>>
>>
>> Doesn't the permissions API allow you to distinguish between 2 and 3?
>> For both those cases, you need to run code in the browser before the
>> distinction is relevant.
>>
>> As for 1, why would you ever have an invalid subscription in your
>> database?
>>
>
>
> _______________________________________________
> Webpush mailing list
> Webpush@ietf.org
> https://www.ietf.org/mailman/listinfo/webpush
>
>