Re: [Webpush] Some comments on webpush server responses

[Ben Last <[e-mail]>]

Hi Martin

As you point out, distinguishing between 2 & 3 requires running code on the
browser. But if the end-user does not return to the website, we can't run
code and therefore can't make that distinction. We may send many messages
between visits. We can't run code in the service worker because there's no
event that can be relied on to fire (since no service workers support
periodic sync, and background sync doesn't allow for repeated events).

As for why we might have an invalid subscription: data may be corrupted, we
may be subject to attacks that send us random subscription data, and we do
see subscriptions sent from compromised versions of Chromium that may or
may not be actually valid. Also, it's probably good design to allow for
this case.

b



—

Ben Last, Senior Full Stack Engineer

[image: Mobify]

Mobile Customer Engagement

mobify.com
<http://www.mobify.com/?utm_source=Email&utm_medium=Email&utm_campaign=email-signature>
|
M 1.604.358.0155 | @benlast <https://twitter.com/@benlast>

Mobify is ranked as a leader in mobile customer engagement. View the Report!
<http://resources.mobify.com/forrester-wave-report-2016.html?utm_source=Email&utm_medium=Email&utm_campaign=email-signature>



On 15 August 2016 at 18:45, Martin Thomson <[e-mail]> wrote:

>
> On 16 August 2016 at 02:50, Ben Last <[e-mail]> wrote:
>
>> It's important for us to be able to distinguish because in case 1 we
>> should remove the subscription, in case 2 we should mark it as blocked (so
>> that website code does not invite the user to resubscribe) and in case 3 we
>> should mark the subscription so that a service worker or website code
>> resubscribes.
>
>
> Doesn't the permissions API allow you to distinguish between 2 and 3?  For
> both those cases, you need to run code in the browser before the
> distinction is relevant.
>
> As for 1, why would you ever have an invalid subscription in your database?
>