Security ramifications of using html5 notifications

[okubbe]

Feedback

It seems like a nice feature to have, but I have no clue of the security risks and ramifications? Could you please add a section about it?

URL

https://www.home-assistant.io/integrations/html5/

Version

2025.10.2

Additional information

No response

[home-assistant]

Hey there @alexyao2015, mind taking a look at this feedback as it has been labeled with an integration (html5) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of html5 can trigger bot actions by commenting:

• @home-assistant close Closes the feedback.
• @home-assistant rename Awesome new title Renames the feedback.
• @home-assistant reopen Reopen the feedback.
• @home-assistant unassign html5 Removes the current integration label and assignees on the feedback, add the integration domain after the command.
• @home-assistant add-label needs-more-information Add a label (needs-more-information) to the feedback.
• @home-assistant remove-label needs-more-information Remove a label (needs-more-information) on the feedback.

[frenck]

clue of the security risks and ramifications?

Not sure what you mean by that? Which security risks or ramifications are you asking for?

[okubbe]

Well I assume that using html5 you can retrieve everywhere in the world such an html notification?
Maybe I do not understand it right. I sketch my scenario that I hope ;-) is the case:
In my mind I have a local home assistent with a raspberry 5. My network is configured as such that no one should be able to access my local netwerk. (unless he/she knows my wifi password). My fiber connection does not allow connection via the internet on my ip network. Now I have the assumption that the html notification is able to send a notification via my glassfiber connection?

[frenck]

It is a cloud push integration, it requires the internet in order to work, yes.

../Frenck

[okubbe]

Ah ok, still for beginners this might be an issue that should be made explicit? My conclusion: I will not install it. Thanks for your clarification :-)

[frenck]

Ah ok, still for beginners this might be an issue that should be made explicit?

It is? Every integration lists this, which includes a link with the different meanings of classifications we have.

[okubbe]

Ok the test is your page:
"ON THIS PAGE

Requirements
Configuration
Setting up your browser
Testing
Usage
Dismiss
Automating notification events
Making notifications work with NGINX proxy
Related topics"

Where should I find information about security?