fix(push): stop web push from posting to arbitrary endpoints

This commit is contained in:
Yun Chan 2026-09-28 00:53:48 +09:00
parent 1afaea7214
commit 043ef579a8
7 changed files with 418 additions and 34 deletions

View file

@ -114,7 +114,7 @@ async function makeSubscription(): Promise<{ registrationId: string; subscriptio
const publicRaw = new Uint8Array(await crypto.subtle.exportKey('raw', uaKeys.publicKey))
const auth = crypto.getRandomValues(new Uint8Array(16))
const subscription: WebPushSubscription = {
endpoint: 'https://push.example.com/subscriptions/abc123',
endpoint: 'https://fcm.googleapis.com/fcm/send/abc123',
p256dh: b64url(publicRaw),
auth: b64url(auth),
}