9 ms·
Demystifying Web Push Notifications
- EngineeringStuf 3y agoI'm surprised to learn that this isn't an open standard. E.g I must make an API call to a browser vendor. Is this a form of vendor lock-in?
- benatkin 3y agoIt’s an open standard but it’s centralized, and not all of it is covered by an open standard. Here’s the page about browser support. https://github.com/web-push-libs/web-push/tree/master#browser-support https://github.com/web-push-libs/web-push/tree/master#browse...
- vmfunction 3y agoWouldn't this be easier to maintain a websocket/socket.io type of connection with the web page? And just push new events from the server to the page directly?
- DaiPlusPlus 3y agoThat wouldn’t scale, and wouldn’t work if the page wasn’t open and active (e.g. suspended tabs, closed browser, etc)
- charcircuit 3y agoThat would waste battery and other resources having to keep a connection open to every possible site that could possibly send you a notification.
- no_time 3y agoIs there a meaningful difference between waking up the CPU from sleep to maintain a single tcp connection vs waking it up to maintain 50? Provided of course all 50 require a keepalive packet at the same time, I don't think so. But feel free to correct me.
- smileybarry 3y agoYes, because the single connection to the push server is hard optimized to stay alive regardless of NAT etc. Cellular carriers have special handling for APNS and GCM, for example. (And I assume there's some kernel & firmware hacks in devices to further offload some handling of APNS/GCM protocol)
- Nextgrid 3y ago> Cellular carriers have special handling for APNS and GCM, for example Would you have any extra info on this? Thanks!
- smileybarry 3y agoNot off the top of my head, but I remember the iPhone in its early years required specific carrier support because of that permanent APNS connection. Can't find a source for this now but I remember that being one of the reasons that iPhone 2G/3G/3GS wouldn't work (well) on other carriers even after SIM unlocking. I assume nowadays it's more to do with GCNAT pruning connections to APNS/GCM less heavily than other "regular" connections (which is doable given that APNS has specific ports[1]), or cell carriers having different routing & handling for push notifications IPs, but that's just speculation. 1: https://support.apple.com/en-us/102266 https://support.apple.com/en-us/102266
- michaelt 3y agoIt would open up a powerful new avenue for tracking users if every browser maintained a permanent, identifiable TCP connection, even when the page was closed, and kept it up as the user moves between wifi and mobile data.
- davidbonachera 3y agoWell, in the git repo, they directly link the RFC https://datatracker.ietf.org/doc/html/rfc8030 https://datatracker.ietf.org/doc/html/rfc8030
- dathinab 3y agoI do like Web Push Notifications. But the way chrome implemented them on Windows makes them the perfect tool for social engineering, sneaking advertisement into windows and other malicious use cases. Worse the controls for disabling them had been a complete UX nightmare last time I took a look at it (both in FF and Chrome; nightmare as in inexperienced users will have issues doing so) making it even more perfect for abuse. And instead of fixing that Google decided to make it semi unusable for many proper use-cases (and FF didn't fix that either). To top that off last time I tried to use them they didn't work on Firefox no idea if that was my firewall, uBlock, Firefox or the websites fault.
- rob74 3y ago> ChatGPT struggled to generate any good code for me, and I also struggled to find any minimal clear explanations online. The two are probably related...
- nhggfu 3y agogreat / detailed write-up OP. hat-tip
- pqvst 3y agoThanks :)
- rompledorph 3y agoStrange, browser tells me domain pqvst.com does not exists
- rompledorph 3y agohttps://web.archive.org/web/20231127082049/https://pqvst.com/2023/11/21/web-push-notifications/ https://web.archive.org/web/20231127082049/https://pqvst.com...
- pqvst 3y agoHuh. What browser?
- rompledorph 3y agoFirefox, but it works fine now…
- unclet 3y agoI have written one blog introducing Web Push Notifications on iOS https://taoshu.in/web/push-on-ios.html https://taoshu.in/web/push-on-ios.html
- Edwinr95 3y agoHow the push service delivers the message to the browser is still mysterious to me. Is Firefox simply hardcoded to poll Mozilla's push service?
- atlasduo 3y agoBasically, yes.
- Jach 3y agoYou can look at your registered service workers by going to about:debugging#/runtime/this-firefox You'll see the ones that can do push give you the URL, something like updates.push.services.mozilla.com/wpush/v2/...
- jonathanlydall 3y agoI haven't looked into this at all, but for desktop I would expect the browser to maintain a WebSocket connection (for all websites) to the browser vendor's "push server", if WebSockets doesn't work for some reason, then it can fall back to long polling. For mobile devices it's discouraged to maintain your own TCP connections for power usage reasons. So I would expect browser developers to have their mobile browsers use the mobile's native push service (e.g. for Android or iOS) to register for pushes, then the browser's backend push service sends push notifications via Apple/Google's push servers which in turn send it to mobile devices themselves.
- awesomeMilou 3y agoYes. Each browser vendor runs a push notification backend, where browsers automatically connect to. Each end user browser instance has a unique identifier with that push backend. As a matter of fact, Mozilla's backend is even open source and written in rust: https://github.com/mozilla-services/autopush-rs/ https://github.com/mozilla-services/autopush-rs/ EDIT: And to send push notifications to an end user as a service provider, you (in simple terms) receive an encoded version of that URI from the push service, along with an authentication token that authorizes you to send notifications to the push service, which will be forwarded to the user that corresponds to the URI.
- amadeuspagel 3y ago
- modeless 3y agoWeb push is basically useless because Google hasn't prioritized fixing the issues causing Android to delay the notifications by 10 minutes or more. They are basically only useful for "re-engagement" spam, nothing time critical. https://bugs.chromium.org/p/chromium/issues/detail?id=777106 https://bugs.chromium.org/p/chromium/issues/detail?id=777106 There are a whole bunch of sad bugs about Web Push in the issue tracker. It's disappointingly typical of the PWA APIs. They sound like they have the capabilities you need until you try to use them and uncover a minefield of five year old known issues that will never be fixed.
- awesomeMilou 3y ago> They sound like they have the capabilities you need I'm curious about what sounds so endearing about them to app developers. I wrote a WebPush scheduler once that implemented the VAPID protocol. Along the road I came across a myriad of resources that hinted at the fact that it's a heavily restricted feature, due to the fact that browser vendors know it's mostly abused for spam. I kinda figured you wouldn't implement them unless you're forced to explore any avenue for engagement.
- michaelt 3y agoTheoretically you might use them for a calendar app reminding people of upcoming appointments, a video call app receiving a call, or things along those lines. Of course we all know that in reality, 99.9% of usage is engagement spam.
- josephg 3y agoYeah. I don’t know why browsers have them enabled by default. Banning web notifications in my browser is one of the first things I do whenever I set up a new machine. I don’t want every second shitty news site to show browser dialogs asking if the site can spam me, even when I’m not on the page. What a horrible experience and a horrible feature.
- modeless 3y agoWhat I'm saying is it's literally not possible to use them for a calendar app or a video calling app or anything along those lines. People simply won't get the notifications until ten minutes after the person called or the calendar event started. (No, it's not consistently 10 minutes, it's random, and can be several hours in the worst case, so you can't schedule the notification earlier to compensate in the calendar case). If these things were possible then maybe people would see the benefit of web push. But spam is the only possible application right now, so spam is all you see. It's really unfortunate because there are many other legitimate uses that should be possible...
- Jach 3y agoGood article. Another VAPID key generator site is helpful, too bad it doesn't seem to work. And even when you have what seems like a valid key, browsers might give errors of the form "Invalid VAPID token" which are very frustrating... And sometimes only happen in Firefox vs Chrome. Would like to see anyone do a more thorough write-up of this part though: > In order to send web push notifications from your backend application server, you have to construct, encode, and encrypt the messages properly. Basically, that's the hardest part, if you don't have library support of someone having done it for you already. Web Push is both simple in design and yet frustrating. I gained some sympathy for sites that have opted not to support it after trying to do it myself without a library on a test page. (I'd only do it for real if anyone besides myself would use it, and just use the library.)
- zoren 3y agoGreat article, thank you for sharing! The web-push package has a generateVAPIDKeys have you tried that? Was it not good since you use vapidkeys.com?
- m_eiman 3y agoIf you're like me you might want to take this as a push to disable all notifications in Firefox: https://superuser.com/questions/1300131/how-to-completely-disable-push-notifications-in-firefox https://superuser.com/questions/1300131/how-to-completely-di...
- harg 3y agoIt's a shame that some sites are abusing this potentially useful feature to try and increase engagement on their site. The correct (IMO) way to use this is to request permission after a user initiates it. E.g. clicking a button somewhere in the UI that says "Enable notifications" whilst being in some context where it makes sense to potentially want to enable them. This is how the web share API works. Calling `navigator.share()` without user interaction will fail as it requires "transient activation"[2] [1]: https://developer.mozilla.org/en-US/docs/Web/API/Web_Share_API https://developer.mozilla.org/en-US/docs/Web/API/Web_Share_A... [2]: https://developer.mozilla.org/en-US/docs/Glossary/Transient_activation https://developer.mozilla.org/en-US/docs/Glossary/Transient_...
- whalesalad 3y ago> It's a shame that some sites are abusing this potentially useful feature to try and increase engagement on their site. First time on the internet?
- marcosdumay 3y agoFirefox requires both that the user initiates the action that enables the push, and that the user then accepts to receive the notifications in a dialog from the browser itself. That question is quite old. Nowadays nobody have that kind of problem.
- dathinab 3y agoyesn't social engineering and people not understanding anything about technology are a thing, I had to disable notifications for an older person before but at least no one who potentially is on HN should have that problem ;=)
- whalesalad 3y agoSrs question, does anyone actually use these?
- genericacct 3y agoSome chat apps use them. I think uptake has been slow because safari was very late to the party
- whalesalad 3y agoI think uptake is slow because no one uses them nor wants them.
- jessehattabaugh 3y agoNo one uses them because they don't work
- whalesalad 3y agoChicken or egg? They don't work because no one wants to put forth resources to fix it, because we're already inundated with notifications everywhere else. Email is fine.
- breckenedge 3y agoYes. I maintain an online forum. We used to have an app, but maintaining it was too expensive. I wanted push notifications, so I added notifications via web push. I’ve got a few hundred signups for the feature, so you can see the scale of our operation doesn’t justify both a mobile app and website. Worst part is that it still requires installing the site as a web app on iOS.
- jeroenhd 3y agoI do.
- zagrebian 3y agoHm, it looks like all Chromium-based browsers, including Edge, Brave, and Samsung Internet, use Google’s endpoint for web push subscriptions. Is that true? If yes, is that a potential privacy issue?
- smileybarry 3y agoEdge uses Microsoft push servers. The endpoint is on "[...].notify.windows.com".
- hospitalJail 3y agoThat is actually pretty cool. But no, I have that turned off. I've never seen a purpose beyond spam.
- dathinab 3y agoI used it with FF mobile. As FF ask you to confirm in a FF controlled dialog there is no risk for spam. At the same time it allowed me to get notifications for a site like with an app without needing to install any app. And at least on FF mobile it was also always clear where the notification is coming, in difference to Windows+Chrome where I had to help an older person to fix an ad problem and it took me an embarrassing long time to realize where the ad is coming from.
- atum47 3y agoI wrote my own push notification in PHP using Server Sent Events. Basically it looks on the database for notifications not sent that are new and then send them. You need to have your browser running in the background but it worked fine for me. Never tested it in large scale though. https://youtu.be/D4wimodtpKk https://youtu.be/D4wimodtpKk
- doubleorseven 3y ago"While you can technically generate your VAPID keys by yourself, it is much easier to use a generator, like vapidkeys.com, which will generate a set of keys for you." Please don't use online tools to generate private keys. Not CSRs, not WG configs or bitcoin wallets, Nothing. Just don't.
- pqvst 3y agoYes. That is a good point. I'll update the post and recommend using a local tool instead.
- deleted 3y ago[deleted]
- tentacleuno 3y ago"You’ll receive an error if a user has revoked the notification permission on your page (or if the subscription has expired). You can catch these errors and remove invalid subscriptions." From an outside perspective, this doesn't seem right -- wouldn't you want to check the error is because the channel has been revoked? It could be due to a temporary outage on either your side or the push server itself. With the code above, you might end up revoking all of your push subscriptions (upon broadcast) if your network goes down.
- HotGarbage 3y agoTo learn web push I made a stupid toy site using Cloudflare to handle the server side of things: https://peter.hotgarba.ge https://peter.hotgarba.ge
- butz 3y agoSad state of PWA: we can send messages to thousands of browsers, but still cannot fire single local alarm on local device which is offline.