Skip to content

feat(notifications): Add WebSocket and Server-Sent Event channels#162

Draft
laurensdeb wants to merge 14 commits into
mainfrom
notifications-streaming
Draft

feat(notifications): Add WebSocket and Server-Sent Event channels#162
laurensdeb wants to merge 14 commits into
mainfrom
notifications-streaming

Conversation

@laurensdeb

@laurensdeb laurensdeb commented May 18, 2026

Copy link
Copy Markdown
Contributor

This is a class 4 change to the protocol. It will need discussion and a WG vote before merging.

This PR adds client-server streaming notification channels on top of the base notifications specification (#161):

  • WebSocket: persistent bidirectional connection for real-time events
  • Server-Sent Events (EventSource): persistent HTTP stream for real-time events

Both channels use capability URLs for connection establishment and share the common notification envelope defined in the base specification.

Depends on #161


Preview | Diff

Introduce a notifications subsystem for LWS with three channels:
Server-Sent Events, WebSocket, and Webhooks.

Key design decisions:
- Single NotificationService with subscriptionType array
- LWS-specific envelope wrapping Activity Streams 2.0 events
- phase property (post-commit) for future admission controller extensibility
- topic property for subscription targets (avoids items collision)
- Webhook authentication via HTTP Message Signatures (RFC 9421)
- inbox aligned with access-request-grant-proposal pattern

Files:
- lws10-notifications/index.html: New subspecification
- lws10-core/Discovery.html: Updated NotificationService example
- README.md: Added notifications to specs list
- Clarify MAY support / MUST advertise pattern for notifications
- Make phase OPTIONAL, use PascalCase (PostCommit)
- Remove forward references to future specifications
- Add Subscriber to terminology, use consistently throughout
- Add Subscription Scope section (recursive container subscriptions)
- Add Subscription Authorization section (delivery-time authz,
  subcontainer filtering, authorization change handling)
- Tighten object structure normatively (nested id/type requirements)
- Add authentication verification relationship per CID 1.0
- Add Activity Streams 2.0 terms to vocabulary table
- Add PostCommit as vocabulary term
- Source external terms from CID-1.0 instead of generic Security Vocab
Replace the Webhook Endpoint term with Inbox — a URL controlled by a
subscriber or other agent to which a server delivers notifications
via HTTP POST. This aligns with the inbox concept used in the
access-request-grant-proposal and makes the term reusable across
LWS subspecifications.
Reference the lws10-notifications specification with a summary of the
three notification channels (SSE, WebSocket, Webhooks) and shared data model.
Remove WebSocket and Server-Sent Event notification channels from the
base notifications specification. These client-server streaming channels
will be introduced in a separate specification.

Remove the phase property from the notification envelope and subscription
request. This concept may be re-introduced at a later point.
Introduce client-server streaming notification channels:
- WebSocket: persistent bidirectional connection for real-time events
- Server-Sent Events (EventSource): persistent HTTP stream for real-time events

Both channels use capability URLs for connection establishment and share
the common notification envelope defined in the base specification.
@laurensdeb

Copy link
Copy Markdown
Contributor Author

See preview

Base automatically changed from notifications-base to main June 8, 2026 05:18
@elf-pavlik

Copy link
Copy Markdown
Member

@laurensdeb I think this one needs a rebase

@elf-pavlik

elf-pavlik commented Jun 12, 2026

Copy link
Copy Markdown
Member

I see three main options here, two of them are included in this PR

  • Websockets
  • Server-Sent Events
  • Streaming HTTP responses (e.g. using regular fetch in a web browser)

Each one comes with some trade-offs. One of main limiting factor is how currently subscription is defined in https://w3c.github.io/lws-protocol/lws10-notifications/#subscriptions
It doesn't provide a way to modify subscriptions, especially by adding and removing topics. With that in mind:

Websockets

👍

  • widely implemented
  • full-duplex (which isn't really used by LWS)

👎

  • not multiplexed - clients may create a lot of TCP connections
  • requires capability url for auth
  • no protocol level Content-Type

SSE

👍

  • widely implemented
  • multiplexed
  • implementations use ping messages to avoid issues with some proxies

👎

  • requires capability url for auth - no way to set Authorization header
  • only Content-Type: text/event-stream

Streaming HTTP

👍

  • multiplexed
  • any Content-Type
  • regular Authorization header available - capability url not required

👎

  • various approaches to use it and limited implementation for streaming content types - may require manual handling of chunks

With Streaming HTTP I only implemented streams with a single topic via GET, where URL can be discovered via link header and it doesn't use subscription step thanks to Authorization header.

@CxRes has more experience with QUERY method as discussed in

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants