Hey there guys! We are currently working on our semester project which allows you to sync notifications across different devices. The notifications themselves are stored on a separate webserver, but we are using the aerogear unified pushserver to start a sync. All the devices which should receive the push (and start the sync) are using the same alias, the push will be triggered by one of these devices On Android it should work fine, since we are able to use the Java Client and the secret without a problem (at least i think the secret would not be visible to anyone on Android). But we are also planning to implement a Chrome Addon and we don't really like the idea to make the master-secret visible to everyone. We know that the unified push server is not intended to be used as client-to-client push server atm, but since the pushes don't contain any important data it would be a sufficient solution to just disable the need for a master-secret if an alias is given (this would at least prevent broadcasts from being sent by third persons). So we wanted to ask you guys which lines of code we should modify inorder to allow pushes without master-secret, if an alias is given? It should only be an additional "if", I guess.. or does it get more complicated? We are currently hosting our unified pushserver on OpenShift (would be nice if you could also roughly tell us how to push the changes onto the server.. do we need to recompile everything?) Cheers, Florian -- View this message in context: http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Allow-Push-Without... Sent from the aerogear-dev mailing list archive at Nabble.com. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Le 17 avr. 2014 à 20:44, Florian Schrofner <florian.schrofner(a)outlook.com&gt; a écrit : Thanks for your answer, this has definitely guided us in the right direction! I'll try to patch and deploy it on a wildfly cartridge in the next few days (currently we were using the aerogear cartridge). Still.. would you recommend another solution? I don't think there are a lot of other options at the moment, unless we want to expose the master-secret (which would make it even worse in my opinion). Also aerogear seems to be our best bet in terms of cross-platform compatibility, so we'd really like to stay with it. -- View this message in context: http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Allow-Push-Without... Sent from the aerogear-dev mailing list archive at Nabble.com. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

I thought about that too.. but I didn't really see the difference, since everybody who knows the link to the broker can also invoke a push without authentication, can't he?

Also setting up another server just for forwarding request seems a bit overpowered to me (and a lot more work)..

As long as I don't unintentionally open a huge security hole by patching the server it shouldn't make that much difference, should it?

Maybe we'll build the first prototypes using the patched aerogear server and switch to the broker later on. Nodejs would be the best option for the broker, I guess?

-- View this message in context: http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Allow-Push-Without... Sent from the aerogear-dev mailing list archive at Nabble.com. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev

Thanks for your link! The broker seems way easier than I thought.. We're going to use the broker, your argumentation convinced us ;) You mentioned a MasterID.. how do I get to know what my MasterID is (in order to block it on the broker)?

I thought it's just alias or no alias (=broadcast)..

Cheers, Florian -- View this message in context: http://aerogear-dev.1069024.n5.nabble.com/aerogear-dev-Allow-Push-Without... Sent from the aerogear-dev mailing list archive at Nabble.com. _______________________________________________ aerogear-dev mailing list aerogear-dev(a)lists.jboss.org https://lists.jboss.org/mailman/listinfo/aerogear-dev