Messaging Token Authentication for Secure Web Push Notifications
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Social-networking systems face challenges in providing operating-system-level features like push notifications to web browsers without proper authentication and security, particularly in preventing cross-site request forgery (CSRF) attacks.
Innovation Solution
Implementing an extra authentication handshake between the web browser and the social-networking system, using a messaging token and verification token to ensure secure delivery of push notifications, and integrating native social-networking application features into web browsers running on client systems.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Speed
If push notifications are delivered directly to web browsers without additional authentication, then notification delivery speed is improved, but security against CSRF attacks deteriorates
Solution Approach 1:
The system performs preliminary authentication by registering a messaging token with the user profile before push notifications are sent. This advance setup includes storing the token in the user profile and establishing the authentication relationship, so that when notifications are delivered, the security verification is already in place and delivery can proceed efficiently.
Solution Approach 2:
The messaging token acts as an intermediary authentication mechanism between the social-networking system and the web browser. Instead of direct communication that would be insecure, the token serves as a verified mediator that proves the browser's legitimacy, allowing secure notification delivery without exposing authentication credentials.
2Reliability
If an extra authentication handshake is implemented, then security against CSRF attacks is improved, but system complexity deteriorates
Solution Approach 1:
The authentication handshake process is merged with the existing push notification registration flow. The messaging token registration is combined with the user profile creation or update process, so that the same interaction that sets up notification delivery also establishes security authentication, eliminating the need for separate authentication steps.
Solution Approach 2:
The messaging token serves multiple functions simultaneously: it identifies the web browser, authenticates the browser's legitimacy against CSRF attacks, and enables push notification delivery. This multi-functional approach consolidates what could be separate complex systems into a single versatile mechanism.
Data Source
AI summary
In one embodiment, a method includes receiving a registration request from an application running on a client system. The registration request includes a messaging token associated with a message-distribution server. In response to the received registration request, the messaging token is registered to a user profile on a social-networking system. A push notification is generated for display at the client system. The push notification and the messaging token are sent to the message-distribution server, where the messaging token identifies the client system to the message-distribution server for delivery of the push notification.