Firefox Web Push: unexpected response (response_code=401)

[moll]

Hey,

Thanks for making Ntfy open-source and maintaining it.

I'm seeing the Web Push notifications failing on Firefox and haven't managed to track down why it happens. Maybe you've seen the same or know where to look.

First, this is with Ntfy v2.17 on Linux 64-bit with Firefox v148 on a self-hosted instance. Created new web push keys, enabled web push in Ntfy, enabled push in the browser, subscribed to a notification channel, and confirmed that there was a subscription present in the webpush SQLite database. Triggered a notification from another device (the mobile app in this case) and saw its delivery to the web push fail the logs. After that, as expected, the subscription gets removed from the web push cache as Ntfy probably considers it invalid.

In the logs, slightly anonymized: DEBUG Unable to publish web push message, unexpected response (message_body_size=125, message_event=message, message_id=ID123, message_sender=1.2.3.4, message_sequence_id=ID123, message_time=1773832676, message_user=u_ATXX, response_code=401, tag=webpush, ..., web_push_subscription_endpoint=https://updates.push.services.mozilla.com/wpush/v2/gAAAAAXXX, web_push_subscription_id=wps_XXX, ...

The trace log level doesn't log the response body either, so I'm not exactly sure what Mozilla's push service responds with the 401 response code.

After that line there's another warning line, but I presume that's just the debug message bubbling up and causing a 500 in Ntfy: WARN Unable to publish web push message (error=internal server error: unable to publish web push message, error_code=50004, http_status=500, message_body_size=125, message_event=message, ...)

I tested it on the hosted instance (https://ntfy.sh) a few minutes ago and there things seem to work. Unless it was something you fixed in the recent versions, though the release notes don't mention anything related to web push.

Checking about:serviceworkers on Firefox seems to nicely show the service worker for both my instance and ntfy.sh. One thing that's different from the hosted variant is that I'm running my instance on a non-standard HTTPS port. Without visibility or knowledge on how web push works, could that be the cause of some errors sending the push to Mozilla's service? I am using a WebPKI cert, so self-signed certs aren't involved either.

Thanks in advance!

[nihalgonsalves]

I would regenerate the web push keys and double-check whether your origin is set correctly. My first guess would be that the origin doesn't match. For example if you rewrite the origin via a reverse proxy, it won't work.

For web push to work, your ntfy base-url and the origin of the site that requests the web push keys have to match. (The origin is basically https://ntfy.example.com- protocol, hostname including domain/subdomain, and port number - 443 implied here).