Re: [Webpush] Voluntary application server identification

[Martin Thomson <[e-mail]>]

On 24 November 2015 at 08:45, Peter Beverloo <[e-mail]> wrote:
> The proposed solution, having a TLS client certificate, has the benefit
> that the certificate's public key could serve as a token for this
> association. Not all alternative solutions have similar shareable tokens.

All the signature-based options have this property (though the -cavage
option would need to be enhanced a little, unless you require the
additional step below).

> Both server identification and subscription association are important for
> us, and, at least initially, mechanisms that we will mandate use of. If
> this proposal works for everybody, we may have to consider a status code
> through which the push service can indicate this.

This is a good point.  The idea being that you could have an
application feed the public key it's application server will use to
the .subscribe() method on the API.  That would propagate up to the
push service and the push service would drop push messages that
weren't signed with the corresponding private key.

I didn't want to introduce too many new concepts at once, but this is
a good idea.  I'd like to keep it optional, of course.