search

w3c / push-api

Push API
https://w3c.github.io/push-api/
Other
145 stars 40 forks source link

How do I authenticate a user #314

Closed ghost closed 3 years ago

ghost commented 5 years ago

In my database, all users don't have login (they are in "groups" which have their own "secrets") and I was wondering if a push subscription has a unique secret that could be used for that. Is "auth" or "p256dh" unique & safe to use as a secret?/

collimarco commented 3 years ago

You can simply associate each push subscription that you store in your database to a user (ID). We use that for Pushpad and it works perfectly.

The "unique secret" is simply the endpoint. That is granted by the standard (consider that in the past the endpoint was the only thing required in order to send a push message).

marcoscaceres commented 3 years ago

Closing as answered.