1) Rejection
Synchronous notifications impossible.
No ideal choice for rejected actions:
- Dropping a rejected action violates reliability semantics.
- Doing work for a rejected action risks a denial of service attack.
One solution:
- Return clients own content back to them along with a simple “NOT PERMITTED” reject message.
- Authentication failures immediately drop all state.
- Denial of service attacks are only possible with authenticated clients.