SmartWeb can deliver push notifications to the browser (including to closed tabs and PWA-installed applications) using the VAPID protocol (RFC 8292, W3C Web Push API). A D2000 ESL script triggers a notification by calling an RPC on the SmartWeb side; the Web Push connector then assembles a VAPID push request and forwards it to the browser endpoints stored in SmartWeb's subscription registry. Elliptic-curve cryptography is provided by Bouncy Castle.

VAPID key pair

VAPID requires an EC (P-256) key pair. The simplest way to generate it is via the web-push CLI:

npx web-push generate-vapid-keys

It prints something like:

=======================================
Public Key:
BK3b8ZvQfcTq...

Private Key:
7Tz2xyz...
=======================================

Both keys are URL-safe Base64-encoded strings.

Configuration

Configure the VAPID keys and enable the Web Push connector:

smartweb:
  application:
    connectors:
      webPush:
        mode: LOCAL                  # LOCAL | REMOTE
        local:
          enabled: true

    api:
      vapid:
        publicKey: "BK3b8ZvQfcTq..."
        privateKey: "7Tz2xyz..."
        subject: "mailto:admin@example.com"

Property	Description

Property	Description
`connectors.webPush.mode`	`LOCAL` — push messages are sent from this SmartWeb process. `REMOTE` — delegation to a remote SmartWeb node.
`connectors.webPush.local.enabled`	Enables the local Web Push connector.
`api.vapid.publicKey`	The VAPID public key (also shared with the browser as the `applicationServerKey`).
`api.vapid.privateKey`	The VAPID private key — keep it secret.
`api.vapid.subject`	A `mailto:` URI or an HTTPS URL identifying the SmartWeb application; required by RFC 8292.

Push notification flow

The browser subscribes to Web Push via PushManager.subscribe() using SmartWeb's VAPID public key.
The browser sends its subscription (endpoint URL, p256dh key, auth secret) to SmartWeb (typically via the REST API or RPC).
SmartWeb stores the subscription associated with the user's session or with their D2000 identity.
An ESL script in D2000 calls a registered RPC method on the SmartWeb side.
The connector encrypts the payload, signs it with the VAPID private key and sends it via POST to every stored browser endpoint.
The browser displays the notification — even when the SmartWeb tab is closed.

Browser-side integration

// Register the service worker and subscribe to Web Push
const registration = await navigator.serviceWorker.register('/sw.js');

const subscription = await registration.pushManager.subscribe({
    userVisibleOnly: true,
    applicationServerKey: 'BK3b8ZvQfcTq...'  // SmartWeb's VAPID public key
});

// Send the subscription to SmartWeb
await fetch('/api/web/rest/v0/d2/rpc', {
    method: 'POST',
    headers: {
        'Content-Type': 'application/json',
        'X-CSRFToken': csrfToken
    },
    body: JSON.stringify({
        event: 'E.PushSubscribe',
        method: 'Subscribe',
        params: {
            endpoint: subscription.endpoint,
            p256dh: btoa(String.fromCharCode(
                ...new Uint8Array(subscription.getKey('p256dh')))),
            auth: btoa(String.fromCharCode(
                ...new Uint8Array(subscription.getKey('auth'))))
        }
    })
});

[!NOTE] If a browser endpoint returns HTTP 410 Gone (the user cancelled the subscription or the browser deleted it), SmartWeb automatically removes the subscription from its registry.

Web Push Configuration

VAPID key pair

Configuration

Push notification flow

Browser-side integration