Push Notification Authentication via Intermediary Server
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Social-networking systems face challenges in providing operating-system-level features like push notifications through web browsers, especially in ensuring secure delivery and authentication, particularly when users update their browser versions or encounter cross-site request forgery (CSRF) attacks.
Innovation Solution
The system implements an additional authentication handshake between the web browser and the social-networking system, using a messaging token and verification token to secure push notifications, and registers this token with the user's profile to ensure only authorized notifications are delivered, thereby protecting against CSRF attacks.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If push notifications are delivered through web browsers without additional authentication, then notification delivery is simple and fast, but security is compromised and CSRF attacks can occur
Solution Approach 1:
A message-distribution server is introduced as an intermediary between the social-networking system and the web browser. This server receives push notifications from the social-networking system, authenticates them using messaging tokens registered in the user profile, and then delivers them to the appropriate web browser. This intermediary layer enables secure authentication without requiring direct complex verification between the browser and social-networking system, thus improving security while maintaining operational simplicity.
2Reliability
If messaging tokens are registered without verification tokens, then registration process is simple, but cross-site request forgery attacks can compromise notification delivery
Solution Approach 1:
Before a messaging token is registered to a user profile, the system performs a preliminary authentication action by sending a verification token to the web browser. The browser must successfully verify this token and complete a registration request with context information before the messaging token is registered. This preliminary verification step ensures that only authenticated browsers can register tokens, preventing CSRF attacks while maintaining a user-friendly registration process through automated verification.
3Reliability
If web browsers can receive push notifications directly, then notification delivery is efficient, but unauthorized access and CSRF attacks become possible
Solution Approach 1:
The message-distribution server acts as a trusted intermediary that handles the authentication and forwarding of push notifications. It receives notifications from the social-networking system, validates them against registered messaging tokens in the user profile, and delivers them to the appropriate web browser. This intermediary approach maintains delivery efficiency by automating the authentication process, while simultaneously improving security by preventing unauthorized direct access between browsers and the notification system.
Data Source
AI summary
In one embodiment, a method includes providing an application programming interface (API) to an application running on a client system. The API is provided based on a user of the client system being logged in to a social-networking system on the application. A first request is received from the application, and the first request includes a new messaging token and a request to register the new messaging token to a user profile of the user on the social-networking system. A verification token is sent to the application. A second request is received from the application, and the second request includes the verification token and context information of the application. The second request is sent by the application using the API. In response to the received requests, a registration of the user profile is updated by discarding a previously-registered messaging token and registering the new messaging token to the user profile.