Hide JabberID use JWE Token

genofire commented

2021-09-14 01:35:05 +02:00

Owner

Net yet implemented: https://github.com/golang-jwt/jwt/issues/67 in go.

Signing is nice but not encrypted

Net yet implemented: https://github.com/golang-jwt/jwt/issues/67 in go. Signing is nice but not encrypted

genofire added the

gateway

help wanted

labels 2021-09-14 01:39:46 +02:00

genofire commented

2021-09-14 08:26:24 +02:00

Author

Owner

Otherwise Token could be unbase64 ... and platform could see the jwt, like in this debugging tool https://jwt.io/

karmanyaahm commented

2021-09-14 22:25:21 +02:00

Collaborator

I'm not sure if this currently works, but not encrypting this could be a feature if app-servers could bypass the distributor and send stuff directly to xmpp in the future using a library that can do the bypass for multiple UP push providers.

genofire commented

2021-09-15 12:51:12 +02:00

Author

Owner

i believe that is not a good idea:

out of UnifiedPush it is an leak of your xmpp address (could be used to spam your directly)
if the app server wants to send direct notification per XMPP, we do not require UnifiedPush (against there Idea to make the push system replaceable like the perpose of the users)

At the moment (the distributor) allows just one push-gateway to pretend point 1:
We could extends the UnifiedPush register system, that the app could ask for a prefered address (with his app-name and app-token), so that the gateway could be part of the app-server.
But therefore we need to change the UnifiedPush specification, before we make changes to this project.

i believe that is not a good idea: 1. out of UnifiedPush it is an leak of your xmpp address (could be used to spam your directly) 2. if the app server wants to send direct notification per XMPP, we do not require UnifiedPush (against there Idea to make the push system replaceable like the perpose of the users) At the moment (the distributor) allows just one push-gateway to pretend point 1: We could extends the UnifiedPush register system, that the app could ask for a prefered address (with his app-name and app-token), so that the gateway could be part of the app-server. But therefore we need to change the UnifiedPush specification, before we make changes to this project.

👍 1

Hide JabberID use JWE Token #5