{"action":"created","issue":{"url":"https://api.github.com/repos/w3c/push-api/issues/185","labels_url":"https://api.github.com/repos/w3c/push-api/issues/185/labels{/name}","comments_url":"https://api.github.com/repos/w3c/push-api/issues/185/comments","events_url":"https://api.github.com/repos/w3c/push-api/issues/185/events","html_url":"https://github.com/w3c/push-api/issues/185","id":129914727,"number":185,"title":"Push API - Authenticating to Push Service","user":{"login":"moresandeep","id":380997,"avatar_url":"https://avatars.githubusercontent.com/u/380997?v=3","gravatar_id":"","url":"https://api.github.com/users/moresandeep","html_url":"https://github.com/moresandeep","followers_url":"https://api.github.com/users/moresandeep/followers","following_url":"https://api.github.com/users/moresandeep/following{/other_user}","gists_url":"https://api.github.com/users/moresandeep/gists{/gist_id}","starred_url":"https://api.github.com/users/moresandeep/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/moresandeep/subscriptions","organizations_url":"https://api.github.com/users/moresandeep/orgs","repos_url":"https://api.github.com/users/moresandeep/repos","events_url":"https://api.github.com/users/moresandeep/events{/privacy}","received_events_url":"https://api.github.com/users/moresandeep/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":5,"created_at":"2016-01-29T23:53:36Z","updated_at":"2016-01-30T01:41:21Z","closed_at":null,"body":"Sorry if this is not the right place, I tried to send an email to the mailing list but kept on getting \r\nlist-help@listhub.w3.org replies.\r\n \r\nAlso, let me apologize in advance if this has already been discussed. \r\nI was going through the Push API specs  and I was thinking about authenticating to the Push Service, specifically between User Agent and Push Service. \r\nCurrently, it looks like there is no way user agent can authenticate to the Push Service (and in turn to application server). \r\n\r\nAs of now anyone can pretty much subscribe to any and all push messages advertised by a Push Service (on behalf of application server), this will not only put extra load on the Push Service but it will also prevent it from letting in only select user agents. I can think of at-least two uses cases where this can be beneficial \r\n1) Say you have an web-application (on application server ) and you only want to push messages to only your registered users.\r\n2) If you want to roll your own Push Service and don't want it to be open to all.\r\n\r\nIn the following subscribe function\r\n`Promise<PushSubscription> subscribe (optional PushSubscriptionOptions options); `\r\n\r\nThere is an optional parameter PushSubscriptionOptions, it appears that this Option is enforced on in-coming messages. \r\n\r\nMaybe, a similar optional parameter such as Authentication can be added here to be passed on to the Push Service. Push Service can then check with \r\na) Application Server or \r\nb) Application Server can share the auth. info. before hand or \r\nc) Push Service can use a gateway in front to authenticate the Worker. \r\n\r\nAuthorization can also be added to this object if required.\r\n\r\nThanks !"},"comment":{"url":"https://api.github.com/repos/w3c/push-api/issues/comments/177043680","html_url":"https://github.com/w3c/push-api/issues/185#issuecomment-177043680","issue_url":"https://api.github.com/repos/w3c/push-api/issues/185","id":177043680,"user":{"login":"beverloo","id":418835,"avatar_url":"https://avatars.githubusercontent.com/u/418835?v=3","gravatar_id":"","url":"https://api.github.com/users/beverloo","html_url":"https://github.com/beverloo","followers_url":"https://api.github.com/users/beverloo/followers","following_url":"https://api.github.com/users/beverloo/following{/other_user}","gists_url":"https://api.github.com/users/beverloo/gists{/gist_id}","starred_url":"https://api.github.com/users/beverloo/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/beverloo/subscriptions","organizations_url":"https://api.github.com/users/beverloo/orgs","repos_url":"https://api.github.com/users/beverloo/repos","events_url":"https://api.github.com/users/beverloo/events{/privacy}","received_events_url":"https://api.github.com/users/beverloo/received_events","type":"User","site_admin":false},"created_at":"2016-01-30T01:41:21Z","updated_at":"2016-01-30T01:41:21Z","body":"Cool. The mailing list would probably be more appropriate for these sort of questions in the future.\r\n\r\nSomeone could close this now? :-)"}}