Re: [Webpush] Alexey Melnikov's Discuss on draft-ietf-webpush-vapid-03: (with DISCUSS and COMMENT)

[Phil Sorber <[e-mail]>]

Alexey,

It appears that two of the three issues were addressed with changes to the
spec. Do you find those changes as well as Martin's explanation of the
third point satisfactory? If not, is there some more concrete changes that
you would like to see?

Thanks.

On Tue, Aug 1, 2017 at 6:14 PM Martin Thomson <[e-mail]>
wrote:

> On 2 August 2017 at 05:55, Alexey Melnikov <[e-mail]> wrote:
> > Firstly, "optjons" above should be "options". Secondly, the MIME type
> > registration of application/webpush-options+json says that the MIME type
> has no
> > parameters, yet you use charset above. So which is it?
>
> As Phil notes, the first was corrected already, the second is in
> c867529 on GitHub.  I'll push a new version at Adam's instruction.
>
> > In Section 3, 3rd para:
> >
> >    This authentication scheme does not require a challenge.  Clients are
> >    able to generate the Authorization header field without any
> >    additional information from a server.  Therefore, a challenge for
> >    this authentication scheme MUST NOT be sent in a WWW-Authenticate
> >    header field.
> >
> > Does this mean that there is no way to discover whether a particular
> server
> > supports "vapid" HTTP authentication scheme?
>
> Not directly.  There was a plan to expose this via the User Agent, but
> we didn't reach a conclusion: https://github.com/w3c/push-api/pull/262
>
> Another document could override this as well, I suppose.  The "MUST
> NOT" exists primarily because we don't define a challenge.
>