<div dir="ltr"><br><div class="gmail_extra"><br><br><div class="gmail_quote">On Tue, Sep 17, 2013 at 7:48 AM, Daniel Bevenius <span dir="ltr"><<a href="mailto:daniel.bevenius@gmail.com" target="_blank">daniel.bevenius@gmail.com</a>></span> wrote:<br>
<blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">We have been discussing the possibility of adding batch notifications support to our SimplePush and UnifiedPush Server. The use case for this would be when doing a selective send using a category, or a broadcast, and instead of sending a number of individual HTTP PUT notifications, a single HTTP PUT notification could be sent. </div>
</blockquote><div><br></div><div style>That's a good idea. When I first start playing with SPS I thought sending PUTs was working this way so for me it's a quite natural "enhancement" </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>
<br></div><div>When sending a notification an endpoint that looks something like this is used:</div><div><a href="https://localhost:7777/update/7linbl5LD9XwCMDfwMeM4vLV8yIwY8Kem32lG2igDngQBqkVPG9u179gpu_y7sxWXvPXpN3-CmLwRpXbJtWAig" target="_blank">https://localhost:7777/update/7linbl5LD9XwCMDfwMeM4vLV8yIwY8Kem32lG2igDngQBqkVPG9u179gpu_y7sxWXvPXpN3-CmLwRpXbJtWAig</a><br>
</div><div><br></div><div>The suggestion for sending batch notifications might work by sending a HTTP PUT but only using:</div><div><a href="https://localhost:7777/update" target="_blank">https://localhost:7777/update</a></div>
<div>In this case the body of the PUT request must be a valid json in the following format:</div>
<div>{</div><div> "version":"1",</div><div> "pushEndpoints":["R32EU3Ct3PuHpEJZbeFQH0JWt_ERUtC4fxox44isNINyWDwatnJ1l1thxQyI1M4-IGvwX3AexkaDiMKpeh3P327MeOm809f9LcCdLw562nOcxxMLmMrhNI4ey4TlQ1mi",</div>
<div>"J_hIZkdLfKZpiwgpQ68QsPPlljnDGBbmPwAwGoe_6mE7ZBaKmebqf1mCDy_c9zII8CyaFC5t9BsGeUSU0nylToQgBKYdV4DFj3zdcpCMnxIHsSpX8Zx9DAjWCv7nfAJz"]</div><div>}<br></div><div><div>The version is pretty much the same as when sending a normal notification except that it is in json format instead of simply 'version=1'. </div>
<div>The pushEndpoints is an array of channel endpoints. The format of these could be different for different SimplePush Server implementations so they are simple strings and the server implementation will know how to interpret them. </div>
<div><br></div><div>Since batch notifications are outside of the SimplePush specification this would only work with our implementation and that will complicate things for the clients, like the UnifiedPush Server for example. It would have to distinguish between our SImplePush implementation and others. </div>
</div></div></blockquote><div><br></div><div style>Is that something in which we could contribute back to Mozilla or at least discuss with us if this could be added to the specs ? </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<div dir="ltr"><div>
<div><br></div><div>Another issue that came up while discussing this is the question if this opens up for denial of service attacks where an attacker could send one batch notification with a long list of pushEndpoints to try to keep the server busy. At the moment, for an attacker to do the same thing he/she would have to send individual request which would be easier to notice and defend against as there would be a high volume of HTTP traffic.</div>
</div></div></blockquote><div style>Should be nice if we had a security expert in the team ... oh wait ... ;) </div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><div dir="ltr">
<div>
<div><br></div><div>Thoughts?</div><div> </div><div><br></div></div></div>
<br>_______________________________________________<br>
aerogear-dev mailing list<br>
<a href="mailto:aerogear-dev@lists.jboss.org">aerogear-dev@lists.jboss.org</a><br>
<a href="https://lists.jboss.org/mailman/listinfo/aerogear-dev" target="_blank">https://lists.jboss.org/mailman/listinfo/aerogear-dev</a><br></blockquote></div><br></div></div>