Re: [Webpush] Stephen Farrell's Discuss on draft-ietf-webpush-protocol-11: (with DISCUSS and COMMENT)

[Stephen Farrell <[e-mail]>]

Hiya,

On 17/10/16 11:04, Martin Thomson wrote:
> On 17 October 2016 at 18:13, Stephen Farrell <[e-mail]> wrote:
>> I think the MAY there is what got me into a confused state.
>> Say if a UA knows to use port 1001 on example.net and just
>> goes there, then the UA will treat the content as having the
>> origin example.net:1001. If however the UA goes to example.net
>> on port 443 first and then sees an alt-svc, then when it goes
>> to port 1001 it'll treat the content as having origin just
>> example.net.
> 
> Correct.  That is a good summary of how Alt-Svc interacts here.
> 
>> I guess that'll make a difference in how the UA
>> handles pushed content.
> 
> Actually it won't because it doesn't treat the content it retrieves as
> belonging to a particular origin.  The information that is received is
> handled by the UA (not any application that resides in it, in the case
> of a browser).
> 
> As a browser, with origins and all that business, we don't actually
> treat content as subject to SOP until we've received the push message,
> decrypted it, and actually handed it to the origin.  Because the
> content we receive from a push service rightfully belongs to many
> origins, we have to treat it specially.

Saying that would've definitely helped me understand
what's going on. Does something need to be stated in
this draft? Or is it safe enough to assume that the
reader will also look at the API and encryption drafts,
and that people won't come up with other ways to handle
pushed messages that don't support good ways to
enforce the SOP?

Cheers,
S.

> 
> The push service is aware of its role in this, so we don't need to ask
> special permission to share either.  It did implement the protocol
> after all.  Thus, the data we source there isn't treated as
> cross-origin.
> 
> We do exactly the same for the geolocation API when we get a location
> from a server.
> 
> (I could also explain how you can follow the crypto and see that the
> data isn't cross-origin at all, but that would be just sophistry.)
> 
> Either way, I believe that what you are asking for rightfully belongs
> in the API part, since we're trying to make the protocol pieces
> ignorant of all that disgusting browser gunk.  Happy to add something
> as editor of the API pieces, but not entirely sure what.  It's strange
> because it's entirely too obvious to me to the point that I didn't
> really know what you were on about, but then you are right that we
> never actually write this stuff down.  Opened
> https://github.com/w3c/push-api/issues/211
>