Subject: [Webpush] Authorization to send messages

From: Benjamin Bangert <[email-masked]>
Date: Thu, 5 Mar 2015 11:33:05 -0800

In webpush http2-02, section 8.3 Authorization doesn't mention how the Push
Service should deal with authenticating an Application Server wishing to
send messages. From conversations I've heard, it does sound like all major
vendors plan on requiring Application Server's to provide some form of
authentication/token as GCM/APNS/etc already do.

It would make sense that if the PUT to the resource URL should fail with an
Authorization Required status, that there could be perhaps some way for an
AppServer developer to determine how they might go about getting
authorization. Perhaps an HTTP Header that indicates where the developer
should go to look at access policies and how to sign-up for the required
authorization.

- Ben

---

From: Martin Thomson <[email-masked]>
Date: Thu, 5 Mar 2015 12:43:39 -0800

> authentication/token as GCM/APNS/etc already do.

It has always been my view that knowledge of the endpoint is necessary
and sufficient here.  But I've gained a more nuanced view over time.

In particular, Costin has suggested that we build a system whereby a
sender can register, thereby establishing a continuous, if
pseudonymous, identity.  That helps with DoS mitigation strategies,
largely because the Push Server can build up a reputation for each
identity over time.