Require pusher URLs to be HTTPS and on /_matrix/push/v1/notify

[turt2live]

as per matrix-org/matrix-spec-proposals#1522

[richvdh]

why is this a thing? why does the pusher need to care what the push gateway's URI is?

[turt2live]

after digging up the conversation in the spec core team room: It's for versioning.

As a requirement for r0 on the push spec, we needed a way to be able to change the format of the endpoint in the future without breaking existing servers and clients, so we mandated that the server validate the endpoint's path to ensure it had a version it could speak.

In the future we might change the request shape of the /notify endpoint, and thus increment the version. These changes might not be backwards compatible, and thus the server will need to know if it needs to speak /v2/notify or /v1/notify to the gateway.

fwiw there was some discussion about us making the hostname or other properties be a version indicator, which might still happen when/if we go to a v2 endpoint.

[richvdh]

that sounds like a surprising way to solve that problem. If the server needs to support multiple notify APIs, then it should be told directly which API it needs to speak, for instance by defining a pusher kind of http_v2, rather than having to infer it from parts of the URI.

[turt2live]

indeed that would be another way to fix it. This was all part of the r0 rush of 2018 though, so was left with a lot of room for improvement.

[richvdh]

ok, I'm going to close this in favour of https://github.com/matrix-org/matrix-doc/issues/2721.