Subject: [Webpush] User Agents should return a list of supported encryption content types
From: JR Conlin <[email-masked]>
To: "[email-masked]" <[email-masked]>
Date: Wed, 19 Apr 2017 13:44:13 -0700
List-Id: Discussion of potential IETF work on a web push protocol <webpush.ietf.org>

Recently, a bug filed against a webpush subscription library highlighted a
shortcoming.

https://github.com/web-push-libs/web-push-php/issues/48#issuecomment-295416292

Currently, there are two in production encryption content types, "aesgcm"
and "aes128gcm". The "voice of authority" about what types of accepted
content types is the UA. The sorts of allowed encryption is not
communicated to the subscription update provider.

I would like to propose that the returned PublishSubscription object <
https://developer.mozilla.org/en-US/docs/Web/API/PushSubscription>
"options" object be modified to include a "contenttypes" list of allowed
ECE content types. (e.g. ['aesgcm', 'aes128gcm']) This method would also
allow future content types to be relayed. If no "contenttypes" field is
present, then the provider must assume "aesgcm" encoding, to allow for
older UAs.

This field would also help indicate "updated" UAs which can take advantage
of the newer draft specifications.

My apologies if this is the wrong group. WebPush and ECE span several and
this is a case where they overlap. I will happily repost to the appropriate
group.