diff --git a/components/ILIAS/Notifications/PRIVACY.md b/components/ILIAS/Notifications/PRIVACY.md index b810052e89a6..6c592761ee0b 100644 --- a/components/ILIAS/Notifications/PRIVACY.md +++ b/components/ILIAS/Notifications/PRIVACY.md @@ -47,4 +47,8 @@ or contribute a fix via [Pull Request](docs/development/contributing.md#pull-req ## Data being exported -- No data is exported in any way +- When a user enables push notifications, the endpoint of the service worker is exposed in a cloud based routing service (like APN, MPS, FCM). +- When a push notification is send ILIAS sends a request to the enpoint with information about the push notifications target device and its content. + - The notification content is only exposed encrypted. + +![Push Notification Routing](./docs/push-notification.svg) diff --git a/components/ILIAS/Notifications/docs/push-notification.svg b/components/ILIAS/Notifications/docs/push-notification.svg new file mode 100644 index 000000000000..7c6684c15362 --- /dev/null +++ b/components/ILIAS/Notifications/docs/push-notification.svg @@ -0,0 +1,29 @@ + + + ILIAS 11 - Web Push: sequence from consent to delivery + + + + + + + + + + + ILIAS 11 — Web Push sequence: consent, subscription, delivery + Default configuration: VAPID + RFC 8291 aes128gcm. The browser chooses the vendor push service; ILIAS only stores and later POSTs to that endpoint. + Solid orange = opt-in (once per browser). Solid blue = later delivery. Dashed grey = reply. Steps 1-22 in chronological order. + User Browser page + Push API ILIAS PHP ilias.php / curl Database push_subscriptions Push Service FCM / Autopush / APNs Service Worker /service-worker.js OS / Notify banner / lock screen Phase A — Opt-in and subscription (once per browser / device) 1 clicks toggle ON Settings > Push Notifications 2 requestPermission() browser / OS dialog 3 grants permission denied aborts the flow 4 pushManager.subscribe({ userVisibleOnly, applicationServerKey }) VAPID public key from ilSetting application_server_key 5 returns { endpoint, p256dh, auth } browser picks FCM / Autopush / APNs; ILIAS never chooses the host 6 POST cmd=addSubscription FormData: JSON.stringify(newSub.toJSON()) 7 INSERT push_subscriptions endpoint, user_id, p256dh, auth (PK) 8 confirmation push (InternalPushProvider) same encrypt + VAPID path as 13-19; user-pref check skipped Phase B — Delivery (later, per notification, one curl POST per stored subscription) 9 push(user, title, desc, link) NotificationsPushProvider | ttl = 60 s 10 notify(): checks enable_push=1 and provider id in usr_pref 11 SELECT subscriptions WHERE user_id = ? | one row per device 12 n rows { endpoint, p256dh, auth } one curl POST per row 13 encrypt + VAPID JWT AES-128-GCM | aud = endpoint origin 14 HTTPS POST subscription.endpoint Authorization: vapid t=<JWT>, k=<pubkey> | Ttl: 60 15 201 Created (404/410: DELETE row) vendor sees ciphertext only 16 deliver encrypted payload desktop: browser TLS mobile: via OS (FCM / APNs / WNS) 17 wake worker, fire 'push' browser decrypts aes128gcm with p256dh + auth 18 showNotification(...) JSON.parse(atob(payload)) 19 banner / tray / lock screen title, body, icon, actions 20 clicks notification 21 notificationclick 22 clients.openWindow(action) session-authenticated ILIAS request, default '/' How to read this, and what the default configuration implies • The endpoint in step 5 is the only routing information ILIAS ever has. Step 14 posts to that stored URL; there is no FCM / Autopush / APNs switch in PHP. • The VAPID JWT in step 13 uses aud = scheme://host of that same endpoint, so the signature is valid only for the vendor that issued the subscription. • A user with Chrome and Firefox produces two rows and two POSTs. 404 or 410 in step 15 deletes that row immediately (stale subscription cleanup). • Push is not an ilNotificationSystem channel (osd / mail). It runs synchronously in the triggering request and has no queue or cron. • Three permissions must all be granted: ILIAS enable_push, the browser Notification permission (step 3), and the OS permission for the browser app. • iOS / iPadOS only complete steps 16-19 when the site is installed as a home-screen PWA. The service worker is registered on every page by Basic.js, independently of push settings.