Text from the attachment:

"Sign into chrome with a user and subscribe to push notification from a site,lets say, <a href="http://Facebook.com">Facebook.com</a></li>
<li>Switch to a new user and log in</li>
<li>Now when push notification arrives it is visible for the new user.</li>"

I'm not sure what the desired behavior here, do we allow push notifications if the user signs out?

+Owen for product, Miguel FYI

I am going to argue that this is working as intended.

For desktop users, the large benefit of Push Notifications is that there is no requirement for the site's tab to be open. I don't see why this would be different for windows— even when there are no windows at all, providing we can get the resource usage requirements in order[1].

From a technical point of view, we don't destroy Profile instances (even when there are no more open windows) so the keyed services stay alive. This includes the GCMProfileService and its connection to GCM.

This does raise two questions in regards to profiles:

  (1) Does the user "sign out" of a profile at all? That's not how it's implemented today.
  (2) Should we attribute profiles on notifications somehow? The UI is very crowded as-is.

I suspect that this issue also applies to many other features, including extension APIs that can run in the background (e.g. alarms, gcm).

[1] 585080

You don't even have to sign out of your account. It
happens even when you switch to a alternate user. 
I don't know but i think a user should not even be able to view push messages regarding other signed in user. This raises serious issue where a system is used by many different user. 

Yes, but from Chrome's point of view the other profile is still active.

Adrienne, Mustafa, I think this boils down to a UX/user expectation issue. WDYT?

If there is an actual 'sign out' step in Chrome profiles then I imagine we should probably stop listening for push at that point, but I don't think there is any such affirmative action.

Is this regarding some variant of the profile switcher where the user has to enter a username and password to access pages with the other profile? If so then it begs the question of what happens when the user clicks a notification from another profile. If not, then this doesn't seem like an issue to me.

Re #5: You can sign out in settings as well as delete profiles. For those cases I agree it would make sense to stop listening for push for that profile.

However if it's just closing a profile which someone could easily reopen by clicking on the profile switcher, then I think this is WAI

OK, I just tested with the attached extension: A non-push notification from an extension is still displayed even if the user closes the window belonging to that profile.

The behavior reported here seems consistent with other profile keyed features, so wontfixing.

Deleted: notifications_test.zip 2.5 KB

notifications_test.zip 2.5 KB Download

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot

This bug has been closed for more than 14 weeks. Removing security view restrictions.

For more details visit https://www.chromium.org/issue-tracking/autotriage - Your friendly Sheriffbot