Re: [Webpush] Alexey Melnikov's Discuss on draft-ietf-webpush-vapid-03: (with DISCUSS and COMMENT)

[Martin Thomson <[e-mail]>]

On 2 August 2017 at 05:55, Alexey Melnikov <[e-mail]> wrote:
> Firstly, "optjons" above should be "options". Secondly, the MIME type
> registration of application/webpush-options+json says that the MIME type has no
> parameters, yet you use charset above. So which is it?

As Phil notes, the first was corrected already, the second is in
c867529 on GitHub.  I'll push a new version at Adam's instruction.

> In Section 3, 3rd para:
>
>    This authentication scheme does not require a challenge.  Clients are
>    able to generate the Authorization header field without any
>    additional information from a server.  Therefore, a challenge for
>    this authentication scheme MUST NOT be sent in a WWW-Authenticate
>    header field.
>
> Does this mean that there is no way to discover whether a particular server
> supports "vapid" HTTP authentication scheme?

Not directly.  There was a plan to expose this via the User Agent, but
we didn't reach a conclusion: https://github.com/w3c/push-api/pull/262

Another document could override this as well, I suppose.  The "MUST
NOT" exists primarily because we don't define a challenge.