Webpush

WebPush is a web technology that enables websites to send messages to a user’s browser even when the site is not currently loaded. It combines the Push API, the Notifications API, and service workers to deliver timely alerts while minimizing the need for active browser tabs. A user must grant consent to receive such notifications, and the browser then creates a subscription object that includes an endpoint URL and cryptographic keys.

In operation, the user subscribes through the website, which registers a service worker and obtains a PushSubscription from the browser. The application server stores the subscription details and, when ready to notify, sends a push message to the subscription endpoint via the browser’s push service. The push service delivers the message to the user’s device, where a service worker handles the push event and may display a notification through the Notifications API. Payloads, when supported, are typically encrypted end-to-end to protect content from intermediate parties.

Standards and security: Web Push is defined by W3C specifications (Push API and Web Push Protocol) and uses encryption (AES-GCM) with an ephemeral key exchange (ECDH). VAPID (Voluntary Application Server Identification) is commonly used to authenticate the sending server. Subscriptions are delivered over TLS, and actual delivery is mediated by platform push services (for example, Google’s FCM for Chrome, Mozilla’s push service, or Apple’s APNs in some contexts).

Use and limitations: WebPush supports real-time or near-real-time notifications for news, transactional updates, and reminders. It depends on user consent and platform support; notifications may be blocked or revoked, and not all browsers or devices deliver payloads in the same way. Privacy considerations include handling subscription data responsibly and respecting user opt-out preferences.