Re: [w3c/push-api] Retry push event (#300)

Another reason for downloading the payload from the application server is that you get **an additional layer of security** (as I [described here](https://pushpad.xyz/security) some years ago). If you send payloads through the push service, an attacker that manages to steal secret data from the application database (e.g. endpoints and keys), can send fraudulent notifications to end users. Instead, if you download notification content from the application server, the hackers won't be able to show any notification... they can only send useless push signals.

-- 
You are receiving this because you are subscribed to this thread.
Reply to this email directly or view it on GitHub:
https://github.com/w3c/push-api/issues/300#issuecomment-424878098