Re: [Webpush] Stephen Farrell's Discuss on draft-ietf-webpush-protocol-11: (with DISCUSS and COMMENT)

[Martin Thomson <[e-mail]>]

On 17 October 2016 at 18:13, Stephen Farrell <[e-mail]> wrote:
> I think the MAY there is what got me into a confused state.
> Say if a UA knows to use port 1001 on example.net and just
> goes there, then the UA will treat the content as having the
> origin example.net:1001. If however the UA goes to example.net
> on port 443 first and then sees an alt-svc, then when it goes
> to port 1001 it'll treat the content as having origin just
> example.net.

Correct.  That is a good summary of how Alt-Svc interacts here.

> I guess that'll make a difference in how the UA
> handles pushed content.

Actually it won't because it doesn't treat the content it retrieves as
belonging to a particular origin.  The information that is received is
handled by the UA (not any application that resides in it, in the case
of a browser).

As a browser, with origins and all that business, we don't actually
treat content as subject to SOP until we've received the push message,
decrypted it, and actually handed it to the origin.  Because the
content we receive from a push service rightfully belongs to many
origins, we have to treat it specially.

The push service is aware of its role in this, so we don't need to ask
special permission to share either.  It did implement the protocol
after all.  Thus, the data we source there isn't treated as
cross-origin.

We do exactly the same for the geolocation API when we get a location
from a server.

(I could also explain how you can follow the crypto and see that the
data isn't cross-origin at all, but that would be just sophistry.)

Either way, I believe that what you are asking for rightfully belongs
in the API part, since we're trying to make the protocol pieces
ignorant of all that disgusting browser gunk.  Happy to add something
as editor of the API pieces, but not entirely sure what.  It's strange
because it's entirely too obvious to me to the point that I didn't
really know what you were on about, but then you are right that we
never actually write this stuff down.  Opened
https://github.com/w3c/push-api/issues/211