[Webpush] Proposal: different push message resource URIs for AS and UA

[Idel Pivnitskiy <[e-mail]>]

Hi all,

push message:  The push service creates a push message resource to
>       identify push messages that have been accepted for delivery
>       (Section 5 <https://tools.ietf.org/html/draft-ietf-webpush-protocol-05#section-5>).  The push message resource is also deleted by the
>       user agent to acknowledge receipt (Section 6.2 <https://tools.ietf.org/html/draft-ietf-webpush-protocol-05#section-6.2>) of a push message.
>
>
And later in the draft we can see that PS returns the same URI for AS and
UA:

/d/qDIYHNcfAIPP_5ITvURr-d6BGtYnTRnk
>
>
It gets ability for an AS to send DELETE request to this URI. Consequently,
it may cause acknowledgement for a PS and sending a push message delivery
receipt to the AS.
Yes, this is a strange behaviour for a proper AS, but a push message
resource URI could be intercepted. Even if the channel between an AS and a
PS is encrypted, attacker can get it from the AS log files. So, I think
that the push message resource URIs must be different for AS and UA, to
prevent this attack by design.

In addition, it will get possibility to provide deletion of sent push
messages for an AS. In case, when push message are not actual at all, but
TTL value was to high.

Best regards,
Idel Pivnitskiy
--
Twitter: @idelpivnitskiy <https://twitter.com/idelpivnitskiy>
GitHub: @idelpivnitskiy <https://github.com/idelpivnitskiy>