Are push notifications possible in html5 without fully https site?

NoBugs picture NoBugs · May 30, 2015 · Viewed 7.5k times · Source

Looks like Push notifications are finally usable for web-apps! Unfortunately, this requires https for ServiceWorker, which not all sites may have.

One thing I noticed in the spec it mentions:

if r's url's scheme is not one of "http" and "https", then: Throw a TypeError."

So I'm confused - can the site be http, as long as it includes a serviceworker that is from https? For example, mydomain.com could include an https serviceworker from https://anotherdomain.com?

Another standard, web-api simple-push, doesn't mention requiring https (likely an omission in the documentation?), and "The user experience on Firefox Desktop has not been drawn out yet". Is the documentation on this outdated, or is push really only supported in FirefoxOS??

Answer

Francisco Jordano picture Francisco Jordano · Jun 1, 2015

Simple-push, that is the current push solution in Firefox OS doesn't have anything to do with ServiceWorkers.

The next generation of push, implemented by both Google and Mozilla will be done through ServiceWorkers:

In that case yes, your content will need to be served over HTTPS.

Probably you will be interested in the LetsEncrypt initiative:

A new certification authority that will help developers to transition their content over HTTPS.

Also just for development purposes, both Google and Mozilla implementations of ServiceWorkers allow you to bypass the check of the secure content, if you develop against localhost. In the case of Mozilla you will need to enable the flag:

devtools.serviceWorkers.testing.enabled: true

But again this will be just for development, and AFAIK, Mozilla push landed or is about to land, and will be available in the nightly builds, you can follow the work here: