Subject: [Webpush] Too strict Crypto-Key restriction imposed by webpush-encryption

From: Peter Beverloo <[email-masked]>
Date: Tue, 28 Jun 2016 17:24:20 +0100

For those not following GitHub:

There is a discrepancy between webpush-encryption[1] and webpush-vapid[2],
where the latter says to use two values in the Crypto-Key header which is
explicitly forbidden by the former.

I've detailed the issue in the following GitHub issue, with an accompanying
pull request relaxing the restriction to a maximum of one Crypto-Key field
having the `dh` parameter:

https://github.com/webpush-wg/webpush-encryption/issues/6

Thanks,
Peter

[1] https://tools.ietf.org/html/draft-ietf-webpush-encryption-02#section-3.2
[2] https://tools.ietf.org/html/draft-ietf-webpush-vapid-00#section-4

---

From: Martin Thomson <[email-masked]>
Date: Wed, 29 Jun 2016 09:46:57 +1000

> https://github.com/webpush-wg/webpush-encryption/issues/6

Which I have merged, since the intent was to limit the number of 'dh'
parameters to 1, not to prevent vapid from being used properly..