Re: [push-api] Permission checks in the push API (#75)

There seems to be a general consensus that the details of the permissions UX are user agent specific. The spec says to reject the promise with a PermissionDeniedError if the user does not grant permission, the rest is up to the UA. I'm closing this issue, but I'm happy to pursue clarifications if it later turns out there is confusion that the spec could prevent.

Chrome currently requires the requesting origin and the embedding (top level) origin to match for the permission request (triggered by subscribe). Here's the PushMessagingPermissionContext class:
https://code.google.com/p/chromium/codesearch#chromium/src/chrome/browser/services/gcm/push_messaging_permission_context.cc&sq=package:chromium&l=81&rcl=1421356211

---
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/75#issuecomment-70513662