Subject: [Webpush] Proposal: different push message resource URIs for AS and UA

From: Idel Pivnitskiy <[email-masked]>
Date: Wed, 1 Jun 2016 22:51:19 +0300

Hi all,

push message:  The push service creates a push message resource to
>       identify push messages that have been accepted for delivery
>       (Section 5 <https://tools.ietf.org/html/draft-ietf-webpush-protocol-05#section-5>).  The push message resource is also deleted by the
>       user agent to acknowledge receipt (Section 6.2 <https://tools.ietf.org/html/draft-ietf-webpush-protocol-05#section-6.2>) of a push message.
>
>
And later in the draft we can see that PS returns the same URI for AS and
UA:

/d/qDIYHNcfAIPP_5ITvURr-d6BGtYnTRnk
It gets ability for an AS to send DELETE request to this URI. Consequently,
it may cause acknowledgement for a PS and sending a push message delivery
receipt to the AS.
Yes, this is a strange behaviour for a proper AS, but a push message
resource URI could be intercepted. Even if the channel between an AS and a
PS is encrypted, attacker can get it from the AS log files. So, I think
that the push message resource URIs must be different for AS and UA, to
prevent this attack by design.

In addition, it will get possibility to provide deletion of sent push
messages for an AS. In case, when push message are not actual at all, but
TTL value was to high.

Best regards,
Idel Pivnitskiy
--
Twitter: @idelpivnitskiy <https://twitter.com/idelpivnitskiy>
GitHub: @idelpivnitskiy <https://github.com/idelpivnitskiy>

---

From: Martin Thomson <[email-masked]>
Date: Thu, 2 Jun 2016 12:11:39 +1000

> it may cause acknowledgement for a PS and sending a push message delivery

I think that this is a feature, not a bug.  If the AS wants to abandon
a push message, this gives it a way.

The other feature that a single URI provides is the fact that UA and
AS can agree about the identity of a push message if that is ever
needed.  (We don't expose this in the push API, so it's not useful in
that context, of course.)

---

From: Idel Pivnitskiy <[email-masked]>
Date: Thu, 2 Jun 2016 15:13:02 +0300

>
>  If the AS wants to abandon a push message, this gives it a way.
>

It's not clear in the draft. Also here is no clarification about how acks
should be implemented. Some implementations, for example, might ignore (or
respond with a error) DELETE /d/... requests for push messages which aren't
sent to the UA yet. Looks like a hack and will not work with each
implementation.

> that context, of course.)

In most cases receiving receipt is enough for AS. I can't imagine situation
when I need identity exact push message, if AS has already received
delivery receipt. In any case, identification of push messages requires
additional communications between UA and AS, which increase power
consumption. It a little bit mismatches with the goal of the draft.
But ok, if we want to keep this feature, we may describe that the first (or
last) n symbols of a push message resource should be identical for AS and
UA. But the whole URI must be different. Just to prevent unexpected
behaviour and completely delineate the opportunities of AS and UA.

Best regards,
Idel Pivnitskiy