{"action":"created","issue":{"url":"https://api.github.com/repos/lkorth/php-gcm/issues/22","repository_url":"https://api.github.com/repos/lkorth/php-gcm","labels_url":"https://api.github.com/repos/lkorth/php-gcm/issues/22/labels{/name}","comments_url":"https://api.github.com/repos/lkorth/php-gcm/issues/22/comments","events_url":"https://api.github.com/repos/lkorth/php-gcm/issues/22/events","html_url":"https://github.com/lkorth/php-gcm/issues/22","id":144999257,"number":22,"title":"Support for Web Push Payload Encryption","user":{"login":"delitestudio","id":14090511,"avatar_url":"https://avatars.githubusercontent.com/u/14090511?v=3","gravatar_id":"","url":"https://api.github.com/users/delitestudio","html_url":"https://github.com/delitestudio","followers_url":"https://api.github.com/users/delitestudio/followers","following_url":"https://api.github.com/users/delitestudio/following{/other_user}","gists_url":"https://api.github.com/users/delitestudio/gists{/gist_id}","starred_url":"https://api.github.com/users/delitestudio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/delitestudio/subscriptions","organizations_url":"https://api.github.com/users/delitestudio/orgs","repos_url":"https://api.github.com/users/delitestudio/repos","events_url":"https://api.github.com/users/delitestudio/events{/privacy}","received_events_url":"https://api.github.com/users/delitestudio/received_events","type":"User","site_admin":false},"labels":[{"url":"https://api.github.com/repos/lkorth/php-gcm/labels/enhancement","name":"enhancement","color":"84b6eb"}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":2,"created_at":"2016-03-31T19:44:53Z","updated_at":"2016-07-27T23:34:43Z","closed_at":null,"body":"Hello, as you know [Google Chrome Push Notifications](https://developers.google.com/web/updates/2015/03/push-notifications-on-the-open-web?hl=en) use GCM. But there is a downside:\r\n\r\n> A downside to the current implementation of the Push API in Chrome is that you can’t send any data with a push message. Nope, nothing. The reason for this is that in a future implementation, payload data will have to be encrypted on your server before it’s sent to a push messaging endpoint. This way the endpoint, whatever push provider it is, will not be able to easily view the content of the push message. This also protects against other vulnerabilities like poor validation of HTTPS certificates and man-in-the-middle attacks between your server and the push provider. However, this encryption isn’t supported yet, so in the meantime you’ll need to perform a fetch to get information needed to populate a notification.\r\n\r\nIn those months Google has implemented a solution that will be available in the new version [Chrome 50](https://developers.google.com/web/updates/2016/03/web-push-encryption?hl=en) at the end of April 2016.\r\n\r\nDo you think this kind of encrypted payload can be implemented into your library?"},"comment":{"url":"https://api.github.com/repos/lkorth/php-gcm/issues/comments/235753504","html_url":"https://github.com/lkorth/php-gcm/issues/22#issuecomment-235753504","issue_url":"https://api.github.com/repos/lkorth/php-gcm/issues/22","id":235753504,"user":{"login":"delitestudio","id":14090511,"avatar_url":"https://avatars.githubusercontent.com/u/14090511?v=3","gravatar_id":"","url":"https://api.github.com/users/delitestudio","html_url":"https://github.com/delitestudio","followers_url":"https://api.github.com/users/delitestudio/followers","following_url":"https://api.github.com/users/delitestudio/following{/other_user}","gists_url":"https://api.github.com/users/delitestudio/gists{/gist_id}","starred_url":"https://api.github.com/users/delitestudio/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/delitestudio/subscriptions","organizations_url":"https://api.github.com/users/delitestudio/orgs","repos_url":"https://api.github.com/users/delitestudio/repos","events_url":"https://api.github.com/users/delitestudio/events{/privacy}","received_events_url":"https://api.github.com/users/delitestudio/received_events","type":"User","site_admin":false},"created_at":"2016-07-27T23:34:43Z","updated_at":"2016-07-27T23:34:43Z","body":"Hello @lkorth, we have implemented some properties on the Message class (publicKey, salt, rawData) with getters and setters.\r\n\r\nWe have then modified the Sender to intercept those properties (only if set) and add appropriate headers:\r\n\r\n```\r\nEncryption: salt=<SALT>\r\nCrypto-Key: dh=<PUBLICKEY>\r\nContent-Encoding: aesgcm\r\n```\r\n\r\nand body field for the notification request (as explained [here](https://developers.google.com/web/updates/2016/03/web-push-encryption)):\r\n\r\n```\r\n{\r\n    \"registration_ids\": [ \"…\" ],\r\n    \"raw_data\": \"BIXzEKOFquzVlr/1tS1bhmobZ…\"\r\n}\r\n```\r\n\r\nThis way your library can be used to send encrypted messages without having to encrypt them: is up to the user to give a correct rawData content.\r\n\r\nHere an example:\r\n\r\n```\r\n$message = new Message();\r\n$message->publicKey($publicKey);\r\n$message->salt($salt);\r\n$message->rawData(base64_encode($encryptedPayload));\r\n```\r\n\r\nIf you are interested we'll make a pull request. At the moment we have implemented it above your latest stable release but it's not hard to port it to the developer one."}}
{"actor":{"display_login":"delitestudio"}}