Re: [Webpush] Vapid public key

[Costin Manolache <[e-mail]>]

Can we do something like:

Authorization: webpush JWT;PUBLICKEY

or even

Authorization: webpush PUBLICKEY:JWT_TOKEN

The public key is the 'identity' of the sender, the JWT token is
authenticating it -
it's common to use USER:SECRET.

I agree having the publickey inside the JWT token - and double b64 - is
ugly, also
it may be easier to verify the signature first, and decode the body after.

Costin

On Tue, Nov 1, 2016 at 8:55 PM Martin Thomson <[e-mail]>
wrote:

> On 2 November 2016 at 05:02, Costin Manolache <[e-mail]> wrote:
> > I would also add that some of the bugs we've seen in our implementation
> > were related to parsing and passing along the crypto key. Even for
> > VAPID I would love to see the sender public key appended to the
> > Authorization header somehow instead of in a separate Crypto-Key header.
>
> Putting the public key in the JWT header is probably doable, but it
> means double base64 encoding for key. I'd want to hear that people are
> OK with it before making a change.
>
> Note that this is probably a net increase in header size (I make it to
> be a 22 octet increase, even losing the Crypto-Key header field
> entirely).  Header size probably isn't that important on this request
> though.
>