starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #1451] Too long topic names are not accepted with 404 error #1023

New issue

Closed

opened 2026-05-07 00:29:38 +02:00 by BreizhHardware · 6 comments

BreizhHardware commented

2026-05-07 00:29:38 +02:00

Owner

Originally created by @rugk on GitHub (Sep 28, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1451

🐞 Describe the bug

I came here from fredy that can publish data on NTFY too. So the linked docs were: https://docs.ntfy.sh/publish/

I read:

Because there is no sign-up, the topic is essentially a password, so pick something that's not easily guessable.

As such, I generated 64 (URL safe) ASCII characters "password" (so as a API key kinda) and added some identificable stuff at the beginning…

However, if you do this, the server responds with a 404 error?

But:

why 404? If you want a deliberate length limit, why not a generic 403 Forbidden or actually. I found out there is an explicit HTTP status code for it HTTP 414 URI Too Long!
why is there such a limit at all? Is it really needed?
And if it is needed at least with a cursory search through the docs I could not find it being mentioned. It should definitively be documented _and_maybe even quite prominently at the beginning to prevent users like me that take your written advise there

💻 Components impacted

ntfy server

💡 Screenshots and/or logs

curl -v -d "This is a long topic 😀" ntfy.sh/longtopic-test-WUdBtebzFeKMZSQftv02HWgKBB3b6kEKvoPe8PsS1As90ELxZkChjtK7PkyzeNio  
* Host ntfy.sh:80 was resolved.
* IPv6: 2604:a880:800:14:0:1:73c0:2000
* IPv4: 159.203.148.75
*   Trying [2604:a880:800:14:0:1:73c0:2000]:80...
* Immediate connect fail for 2604:a880:800:14:0:1:73c0:2000: Das Netzwerk ist nicht erreichbar
*   Trying 159.203.148.75:80...
* Connected to ntfy.sh (159.203.148.75) port 80
* using HTTP/1.x
> POST /longtopic-test-WUdBtebzFeKMZSQftv02HWgKBB3b6kEKvoPe8PsS1As90ELxZkChjtK7PkyzeNio HTTP/1.1
> Host: ntfy.sh
> User-Agent: curl/8.11.1
> Accept: */*
> Content-Length: 25
> Content-Type: application/x-www-form-urlencoded
> 
* upload completely sent off: 25 bytes
< HTTP/1.1 404 Not Found
< Server: nginx
< Date: Sun, 28 Sep 2025 23:00:15 GMT
< Content-Type: application/json
< Content-Length: 51
< Connection: keep-alive
< Access-Control-Allow-Origin: *
< 
{"code":40401,"http":404,"error":"page not found"}
* Connection #0 to host ntfy.sh left intact

🔮 Additional context

Offtopic, but I can create a new issue about that if you want:

"the topic is essentially a password" should IMHO be a bigger warning (like GitHub's markdown warning block as I had to read the page a little more than needed to find that doc snippet. And it's important, because if this gets more popular I'd bet many people – in the worst case – use the default string mentioned in the docs .
to ease the UX even more and convince people this (= security) is actually a good idea, you cold even add a little generator for your topic URL that locally i the client (via JS), generates a topic like topicname_somelonghash. Have a big button "generate topic name" and I guess this will easily lead to people using it.
Also, this makes it easier for new users like me that first have to understand the doc what a "topic" actually is/refers to. As I came from that third-party application linking to you with a text like this, it may be a good idea to have it:

For ntfy, you need to create a topic on your preferred ntfy instance. This is pretty easy. Please visit the steps in the docs and follow the instructions.

If you want to make it even better, you could create a separate page or even workflow for a "generate URL and return to third-party" (like OAuth) that simplifies the UX to simply pressing button to generate that and return it to the client.

Originally created by @rugk on GitHub (Sep 28, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1451 :lady_beetle: **Describe the bug**  I came here from [fredy](https://github.com/orangecoding/fredy) that can publish data on NTFY too. So the linked docs were: https://docs.ntfy.sh/publish/ I read: > Because there is no sign-up, the topic is essentially a password, so pick something that's not easily guessable. As such, I generated 64 (URL safe) ASCII characters "password" (so as a API key kinda) and added some identificable stuff at the beginning… However, if you do this, the server responds with a 404 error? But: * why 404? If you want a deliberate length limit, why not a generic _403 Forbidden_ or actually. I found out [there is an explicit HTTP status code for it](https://developer.mozilla.org/docs/Web/HTTP/Reference/Status/414) _HTTP 414 URI Too Long_! * why is there such a limit at all? Is it really needed? * And if it is needed at least with a cursory search through the docs I could not find it being mentioned. It should definitively be documented _and_maybe even quite prominently at the beginning to prevent users like me that take your written advise there :computer: **Components impacted**  ntfy server :bulb: **Screenshots and/or logs**  ``` curl -v -d "This is a long topic 😀" ntfy.sh/longtopic-test-WUdBtebzFeKMZSQftv02HWgKBB3b6kEKvoPe8PsS1As90ELxZkChjtK7PkyzeNio * Host ntfy.sh:80 was resolved. * IPv6: 2604:a880:800:14:0:1:73c0:2000 * IPv4: 159.203.148.75 * Trying [2604:a880:800:14:0:1:73c0:2000]:80... * Immediate connect fail for 2604:a880:800:14:0:1:73c0:2000: Das Netzwerk ist nicht erreichbar * Trying 159.203.148.75:80... * Connected to ntfy.sh (159.203.148.75) port 80 * using HTTP/1.x > POST /longtopic-test-WUdBtebzFeKMZSQftv02HWgKBB3b6kEKvoPe8PsS1As90ELxZkChjtK7PkyzeNio HTTP/1.1 > Host: ntfy.sh > User-Agent: curl/8.11.1 > Accept: */* > Content-Length: 25 > Content-Type: application/x-www-form-urlencoded > * upload completely sent off: 25 bytes < HTTP/1.1 404 Not Found < Server: nginx < Date: Sun, 28 Sep 2025 23:00:15 GMT < Content-Type: application/json < Content-Length: 51 < Connection: keep-alive < Access-Control-Allow-Origin: * < {"code":40401,"http":404,"error":"page not found"} * Connection #0 to host ntfy.sh left intact ``` :crystal_ball: **Additional context**  Offtopic, but I can create a new issue about that if you want: * "the topic is essentially a password" should IMHO be a bigger warning (like [GitHub's markdown warning block](https://github.com/orgs/community/discussions/16925) as I had to read the page a little more than needed to find that doc snippet. And it's important, because if this gets more popular I'd bet many people – in the worst case – use the default string mentioned in the docs . * to ease the UX even more and convince people this (= security) is actually a good idea, you cold even add a little generator for your topic URL that locally i the client (via JS), generates a topic like `topicname_somelonghash`. Have a big button "generate topic name" and I guess this will easily lead to people using it. Also, this makes it easier for new users like me that first have to understand the doc what a "topic" actually is/refers to. As I came from that third-party application linking to you with a text like this, it may be a good idea to have it: > For ntfy, you need to create a topic on your preferred ntfy instance. This is pretty easy. Please visit the steps in the [docs](https://docs.ntfy.sh/publish/) and follow the instructions. If you want to make it even better, you could create a separate page or even workflow for a "generate URL and return to third-party" (like OAuth) that simplifies the UX to simply pressing button to generate that and return it to the client.

BreizhHardware

2026-05-07 00:29:38 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:29:39 +02:00

Author

Owner

@wunter8 commented on GitHub (Sep 29, 2025):

Topics are limited to 64 characters long (github.com/binwiederhier/ntfy@7615aa86ad/server/server.go (L74))

I couldn't quickly find that limit in the docs, so it would probably be good to add.

We could probably change the HTTP error to 414 instead of 404. I didn't know that one exists either.

The web app does have a "generate random topic" button already. It might be added to the mobile apps at some point

@wunter8 commented on GitHub (Sep 29, 2025): Topics are limited to 64 characters long (https://github.com/binwiederhier/ntfy/blob/7615aa86adddc35648ccf13a26cd0f020380e038/server/server.go#L74) I couldn't quickly find that limit in the docs, so it would probably be good to add. We could probably change the HTTP error to 414 instead of 404. I didn't know that one exists either. The web app does have a "generate random topic" button already. It might be added to the mobile apps at some point

BreizhHardware commented

2026-05-07 00:29:39 +02:00

Author

Owner

@rugk commented on GitHub (Sep 29, 2025):

We could probably change the HTTP error to 414 instead of 404. I didn't know that one exists either.

Yeah, I mean 404 is totally wrong/incompatible, is not it? The topic is supposed to be created when accessed, so a response "does not exist" does not really make sense and does not explain what the error at all, is. I mean, after I first encountered this error, it was just my "programming intuition" that lead me to try a shorter URL/topic.
I mean the message also really needs to be adjusted.

The web app does have a "generate random topic" button already. It might be added to the mobile apps at some point

Uhm sorry, where? At https://docs.ntfy.sh/publish/ I did not found that.

@rugk commented on GitHub (Sep 29, 2025): > We could probably change the HTTP error to 414 instead of 404. I didn't know that one exists either. Yeah, I mean 404 is totally wrong/incompatible, is not it? The topic is supposed to be created when accessed, so a response "does not exist" does not really make sense and does not explain what the error at all, is. I mean, after I first encountered this error, it was just my "programming intuition" that lead me to try a shorter URL/topic. I mean the `message` also really needs to be adjusted. > The web app does have a "generate random topic" button already. It might be added to the mobile apps at some point Uhm sorry, where? At https://docs.ntfy.sh/publish/ I did not found that.

BreizhHardware commented

2026-05-07 00:29:39 +02:00

Author

Owner

@wunter8 commented on GitHub (Sep 29, 2025):

The web app can be accessed here: https://ntfy.sh/app

When you subscribe to a new topic, you're presented with this dialog, which has the "generate name" button

@wunter8 commented on GitHub (Sep 29, 2025): The web app can be accessed here: https://ntfy.sh/app When you subscribe to a new topic, you're presented with this dialog, which has the "generate name" button <img width="657" height="373" alt="Image" src="https://github.com/user-attachments/assets/e4383ed3-2e8e-4ad8-ba33-87c0828eaa2a" />

BreizhHardware commented

2026-05-07 00:29:39 +02:00

Author

Owner

@rugk commented on GitHub (Sep 29, 2025):

Ah well okay thx. As said for the docs this may alos be useful, but anyway is quite off-topic, so shall I open a new issue?

@rugk commented on GitHub (Sep 29, 2025): Ah well okay thx. As said for the docs this may alos be useful, but anyway is quite off-topic, so shall I open a new issue?

BreizhHardware commented

2026-05-07 00:29:40 +02:00

Author

Owner

@wunter8 commented on GitHub (Sep 29, 2025):

Sure. Or if you find a good spot for this, you can just submit a PR adding it to the docs yourself

@wunter8 commented on GitHub (Sep 29, 2025): Sure. Or if you find a good spot for this, you can just submit a PR adding it to the docs yourself

BreizhHardware commented

2026-05-07 00:29:40 +02:00

Author

Owner

@rugk commented on GitHub (Sep 30, 2025):

It's unfortunately not as easy, because it's not a doc text change but a whole component so… But here: https://github.com/binwiederhier/ntfy/issues/1452

@rugk commented on GitHub (Sep 30, 2025): It's unfortunately not as easy, because it's not a doc text change but a whole component so… But here: https://github.com/binwiederhier/ntfy/issues/1452