Security Vulnerabilities Guide

Understanding and fixing common web security vulnerabilities detected by VitaPulse

Medium

Notification Permission on Page Load

Your site requests notification permission immediately when the page loads, before any user interaction.

Risk

Unsolicited notification prompts are one of the most annoying web patterns. Users overwhelmingly deny or ignore them. Chrome now suppresses notification prompts on sites with low acceptance rates. This can permanently prevent your site from showing notifications and negatively impacts user experience metrics.

Solution

Only request notification permission after the user expresses interest (e.g., clicking a 'Subscribe to updates' button). Show a custom in-page prompt explaining the value before triggering the browser prompt.

Example

// Good: Custom prompt first, then browser prompt
subscribeBtn.addEventListener('click', () => {
  Notification.requestPermission();
});

Push Notifications UX - web.dev

Comments (0)

No messages yet.