Intent to Deprecate: GCM-based subscriptions for Web Push Notifications

[Peter Beverloo]

Primary eng (and PM) emails
pe...@chromium.org, pjmcl...@google.com, poz...@google.com

Summary
Chrome introduced Web Push Notifications in M42, based on proprietary GCM authentication that requires people to create a Google Cloud Project ID. A year later, in M52, we improved this by launching support for VAPID, a mechanism that continues to strictly associate messages with a particular sender, but no longer relies on proprietary mechanisms for obtaining that identifier.

- https://developers.google.com/web/updates/2015/03/push-notifications-on-the-open-web
- https://developers.google.com/web/updates/2016/07/web-push-interop-wins
- https://tools.ietf.org/html/rfc8292

Per this Intent we'd like to deprecate support for GCM-based authentication. Since this is sizable and depends on server-side changes, we'd like to follow a particular timeline:

• June: Deprecation warning in the DevTools console (M76), publish updated documentation
• July: List of accepted Sender IDs frozen on the server. Existing ones will continue to work, but new ones will not be accepted
• July–February: Pro-active outreach to affected developers
• February (M80): Removal of support for GCM authentication

A separate Intent to Remove will be send closer to the time with statistics on the deprecation. We've already been in contact with a number of large parties to ask for their feedback.

Motivation
Other vendors are not able to support non-VAPID based subscriptions, so this stands in the way of interoperability.

Interoperability and Compatibility Risk
Edge: Not supported, positive to removal
Firefox: Not supported, positive to removal
Safari: Does not support Web Push Notifications

This removes support for something that's proprietary to Google.

Alternative implementation suggestion for web developers
Migrate subscriptions that have been created based on a GCM "sender ID" to new ones created with VAPID keys. This can be done without any user impact. Our documentation has already been updated to match the best practices:

https://developers.google.com/web/fundamentals/push-notifications/

Usage information from UseCounter
The impact metrics are sourced from our servers, so I'm unfortunately not able to share that.

It's sizable, which is why we've already reached out to the larger affected parties and propose the aforementioned deprecation path. Because the affected websites use a Google Cloud Project ID, we have the ability to contact them directly once this deprecation has been approved.

Entry on the feature dashboard
https://www.chromestatus.com/feature/5573539073622016

Requesting approval to remove too?
No. A separate Intent to Remove will be send closer to the time with statistics on the deprecation.

[Michaela Merz]

I don't have any issue with the removal of GCM based web-push. However - wouldn't it be time to make web-push useful by allowing web-push to work even when the device is dozing? What good is push notification if the users won't be able to get it due to his/her phone being in a coma?

See Error https://bugs.chromium.org/p/chromium/issues/detail?id=777106&can=8&q=&colspec=ID%20Pri%20M%20Stars%20ReleaseBlock%20Component%20Status%20Owner%20Summary%20OS%20Modified

[Alex Russell]

LGTM

[rschwa...@gmail.com]

Is there an update to this timeline? There's no mention of GCM-based authentication being removed in M80 release notes and no Intent to Remove has been sent either. How much longer will existing subscriptions created based on a GCM "sender ID" continue to work?

[Peter Beverloo]

Hi all -

Due to continued usage the deprecation has been pushed back to Chrome 81. The latest timeline and status can be found in the tracking issue here:

https://bugs.chromium.org/p/chromium/issues/detail?id=979235

Chrome will disallow creating new subscriptions that use GCM Sender IDs, but will continue to deliver messages for existing subscriptions.

Thanks,

Peter

--
You received this message because you are subscribed to the Google Groups "blink-dev" group.
To unsubscribe from this group and stop receiving emails from it, send an email to blink-dev+...@chromium.org.
To view this discussion on the web visit https://groups.google.com/a/chromium.org/d/msgid/blink-dev/abc3b063-83fb-476e-b050-1535066d196d%40chromium.org.