[Issues on Push Message] about chat HOT 5 CLOSED

Hi Riandy,

FCM token refresh in the middle of user session

Yes, it's an oversight. This functionality is needed but missing. I see two options: allow {hi} in the middle of the session or create a new packet for the purpose, like {dev}. Let me look at the code and I'll suggest which one is more suitable.

User logout in app

So, if I understand correctly, when user logs out from the device, the app needs a way to tell the server to invalidate the token. But maybe it's not needed. Since tokens are stored by UID, if the same token is used with a new UID the server can detect that and then invalidate the token for the old UID. I think the automatic token invalidation is better than explicit because it will not allow a malicious client to intentionally receive pushes for a different user. If you don't see problems with this approach, I'll add automatic token deletion on the server.

Also if I may suggest I think it's better if we differentiate between deviceId & fcm token though. The reason is because essentialy a device may have multiple tokens due to rotation / refresh.

But what is deviceId then? I don't think there is a need for a deviceId separate from the push token. Just think of deviceId as a different name for the token.
As for stale deviceId (or token), I think it needs garbage collection - automatically delete deviceId/token after a month of two of inactivity.

from chat.

I think the automatic token invalidation is better than explicit because it will not allow a malicious client to intentionally receive pushes for a different user.

Yeah, you’re right it’s much better (y).

Maybe the trade off is when user already logged out then move to new device, they would still receive the notification in the old device. Maybe you have suggestion regarding this case?

But what is deviceId then?

I was thinking to use InstanceID

from chat.

Maybe the trade off is when user already logged out then move to new device, they would still receive the notification in the old device. Maybe you have suggestion regarding this case?

I'm thinking about adding a way of updating the token which should cover both cases:

1. Replace old token with the new token
2. Replace token with null

I was thinking to use InstanceID

It's not going to be used on the backend so I would rather not collect it.

from chat.

I think allowing {hi} in the middle of a session is the simplest solution: #51

from chat.

Hello, Gene

Yeah, it’s awesome 👍

I have a little bit fix for null params in {hi} response though: #55

Thanks

from chat.