Warning: When implementing PushManager subscriptions, it is vitally important that you protect against CSRF/XSRF issues in your app. See the following articles for more information:
For an app to receive push messages, it has to have an active PushManager.subscribe()
.
The resulting PushSubscription
includes all the information that the application needs to send a push message: an endpoint and the encryption key needed for sending data.
The service worker will be started as necessary to handle incoming push messages, which are delivered to the ServiceWorkerRegistration.showNotification()
.)
Each subscription is unique to a service worker. The endpoint for the subscription is a unique capability URL: knowledge of the endpoint is all that is necessary to send a message to your application. The endpoint URL therefore needs to be kept secret, or other applications might be able to send push messages to your application.
Activating a service worker to deliver a push message can result in increased resource usage, particularly of the battery. Different browsers have different schemes for handling this, there is currently no standard mechanism. Firefox allows a limited number (quota) of push messages to be sent to an application, although Push messages that generate notifications are exempt from this limit. The limit is refreshed each time the site is visited. In Chrome there are no limits.