Re: [Webpush] Voluntary Application Server Identification -02

[jr conlin <[e-mail]>]

On 2/11/2016 2:41 AM, Martin Thomson wrote:
> On 11 February 2016 at 17:25, Costin Manolache <[e-mail]> wrote:
>> The key used in register() needs to be included in the push request -
>> technically we can work around this, by having the
>> push service store the key - but by having it in the push header it can
>> reduce the storage ( the push service can
>> only store a hash of the key, or can include a hash of the key in the
>> registration token, so no storage - assuming the registration is
>> encrypted/signed).
> Like Costin, I'm confused about the need to restate the first point.
> The whole purpose of including a key in the subscription is to limit
> pushes to application servers that have the corresponding private key.
> See https://martinthomson.github.io/webpush-vapid/#using-restricted-subscriptions
> and https://github.com/w3c/push-api/pull/182

I tend to prefer limiting the amount of data exchange required. Since
the Crypto-Key component would match the previously provided register()
key, it seemed redundant to provided it on every subsequent call. Having
discussed things with Ben and Kit offline, I'm fine with the public key
being included in both, in order to make things easier for the
Application server creators.