info
Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
Intent to ship Notification API on Web Workers
57 views
Skip to first unread message
nsm.n...@gmail.com
Jun 29, 2015, 11:46:44 PM6/29/15
to
Hello,
Target release: Firefox 41
Implementation and shipping bug: https://bugzilla.mozilla.org/buglist.cgi?quicksearch=916893
Specification: https://notifications.spec.whatwg.org/
Gecko already implements support for the Notification API on window behind the dom.webnotifications.enabled pref, and this has been enabled by default for at least a year. This is the intent to ship the same API on workers, guarded by the same pref, so it will be enabled by default.
The patches landed on central on July 29, 2015. These patches implement support for the Notification constructor on dedicated and shared workers. This is exposed via the Notification constructor.
The Service Worker parts of the Notification API are not shipping yet due to breaking some Gaia tests. That implementation is tracked in https://bugzilla.mozilla.org/show_bug.cgi?id=1114554
Potential for abuse?
This API allows workers to abuse the user. There are some safeguards in place.
1) Notification.requestPermission() which prompts the user to grant permission is only available on window. This means the website cannot secretly acquire permission. It is also clear to the user which origin is requesting the permission.
2) Each notification displays the origin it came from. The user can revoke permission using the standard user agent mechanisms (Page Info in Firefox).
Platforms: All platforms.
Support in other engines:
Blink - shipped - https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/4WNnq8BIydI
Webkit - I don't have a way to try this out, but from the Blink intent to ship, it seems it isn't supported.
Edge/Trident: not supported
Developer documentation: https://developer.mozilla.org/en-US/docs/Web/API/Notification/Notification, the doc has not been updated for worker support yet.
Target release: Firefox 41
Implementation and shipping bug: https://bugzilla.mozilla.org/buglist.cgi?quicksearch=916893
Specification: https://notifications.spec.whatwg.org/
Gecko already implements support for the Notification API on window behind the dom.webnotifications.enabled pref, and this has been enabled by default for at least a year. This is the intent to ship the same API on workers, guarded by the same pref, so it will be enabled by default.
The patches landed on central on July 29, 2015. These patches implement support for the Notification constructor on dedicated and shared workers. This is exposed via the Notification constructor.
The Service Worker parts of the Notification API are not shipping yet due to breaking some Gaia tests. That implementation is tracked in https://bugzilla.mozilla.org/show_bug.cgi?id=1114554
Potential for abuse?
This API allows workers to abuse the user. There are some safeguards in place.
1) Notification.requestPermission() which prompts the user to grant permission is only available on window. This means the website cannot secretly acquire permission. It is also clear to the user which origin is requesting the permission.
2) Each notification displays the origin it came from. The user can revoke permission using the standard user agent mechanisms (Page Info in Firefox).
Platforms: All platforms.
Support in other engines:
Blink - shipped - https://groups.google.com/a/chromium.org/forum/#!topic/blink-dev/4WNnq8BIydI
Webkit - I don't have a way to try this out, but from the Blink intent to ship, it seems it isn't supported.
Edge/Trident: not supported
Developer documentation: https://developer.mozilla.org/en-US/docs/Web/API/Notification/Notification, the doc has not been updated for worker support yet.
smaug
Jun 30, 2015, 5:13:21 PM6/30/15
to
yes, please!
0 new messages