Re: [w3c/push-api] Some things about the PushEncryptionKeys p256dh and auth are not clear enough (#212)

> But this only works if I can be totally sure, that an endpoint without keys would always trigger pushsubscriptionchange as soon as endpoint-keys are added and that existing keys are not changed without calling pushsubscriptionchange. 

Maybe it's also worth calling out as an example in 11.2: "For example, the push service MAY set an expiration time, or the user agent MAY rotate the push message encryption keys."

You're completely correct: if the keys change, the service worker and app server need to know. Otherwise, any messages sent to that subscription using the old keys will be dropped, because the browser will fail to decrypt them with the new keys.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/212#issuecomment-256209380