WebSub: standardizing HTTP push subscriptions

WebSub defines a notification protocol between publishers and subscribers: a subscriber discovers a hub, registers a callback URL, and receives updates from the hub over HTTP. The specification covers subscription validation, renewal, and delivery retries, while leaving the mechanism publishers use to notify hubs unspecified.

The updated W3C Recommendation adds safeguards against XSS attacks during subscription verification. It also specifies HMAC signatures for notifications: SHA-1 remains common for compatibility, the document notes, but recommends at least SHA-256 when TLS transport may be compromised.