starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #1497] ntfy.sh/app WebPush Notifications do not work with ntfy UnifiedPush Distributor #1057

New issue

Open

opened 2026-05-07 00:29:56 +02:00 by BreizhHardware · 9 comments

BreizhHardware commented

2026-05-07 00:29:56 +02:00

Owner

Originally created by @bam80 on GitHub (Nov 24, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1497

🔮 Additional context

They only work with Sunup.
See details here:
https://codeberg.org/UnifiedPush/wishlist/issues/27#issuecomment-5786435
Why it doesn't work:

They use an allow list: binwiederhier/ntfy@3c8ac4a1e1/server/server_webpush.go (L20)

Originally created by @bam80 on GitHub (Nov 24, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1497 :crystal_ball: **Additional context**  They only work with Sunup. See details here: https://codeberg.org/UnifiedPush/wishlist/issues/27#issuecomment-5786435 Why it doesn't work: > They use an allow list: [binwiederhier/ntfy@3c8ac4a1e1/server/server_webpush.go (L20)](https://github.com/binwiederhier/ntfy/blob/3c8ac4a1e14919705b305d7eddc89e546c7bac56/server/server_webpush.go#L20)

BreizhHardware added the

🪲 bug

label

2026-05-07 00:29:56 +02:00

BreizhHardware commented

2026-05-07 00:29:56 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 1, 2026):

I'm paging @p1gp1g for help on this one. Is this something that can be easily addressed in ntfy?

@binwiederhier commented on GitHub (Feb 1, 2026): I'm paging @p1gp1g for help on this one. Is this something that can be easily addressed in ntfy?

BreizhHardware commented

2026-05-07 00:29:56 +02:00

Author

Owner

@p1gp1g commented on GitHub (Feb 16, 2026):

I think it can be addressed easily: instead of relying on an allow list, you can use paranoid-http client for the POST to the push servers, it forbids private IPs

You can take example on common-proxies: codeberg.org/UnifiedPush/common-proxies@d0b7d9d14d/handler.go (L23)

If you also wish to push to a configured private IP - which is probably not the case for ntfy - you can add a configuration that allow a domain: codeberg.org/UnifiedPush/common-proxies@d0b7d9d14d/handler.go (L81)

@p1gp1g commented on GitHub (Feb 16, 2026): I think it can be addressed easily: instead of relying on an allow list, you can use [paranoid-http](https://github.com/hakobe/paranoidhttp) client for the POST to the push servers, it forbids private IPs You can take example on [common-proxies](https://codeberg.org/UnifiedPush/common-proxies): https://codeberg.org/UnifiedPush/common-proxies/src/commit/d0b7d9d14d8bd0e334f236fa3e463581a67c56b7/handler.go#L23 If you also wish to push to a configured private IP - which is probably not the case for ntfy - you can add a configuration that allow a domain: https://codeberg.org/UnifiedPush/common-proxies/src/commit/d0b7d9d14d8bd0e334f236fa3e463581a67c56b7/handler.go#L81

BreizhHardware commented

2026-05-07 00:29:56 +02:00

Author

Owner

@wrenix commented on GitHub (Mar 17, 2026):

I was already writing an duplicated Issue .. this problem exists also on own hosted WebPush-Server (e.g. autopush).

Please make the AllowList configurable.

@wrenix commented on GitHub (Mar 17, 2026): I was already writing an duplicated Issue .. this problem exists also on own hosted WebPush-Server (e.g. autopush). Please make the AllowList configurable.

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@binwiederhier commented on GitHub (Mar 17, 2026):

I struggle to understand the use case entirely. I'm more than happy to implement thongs but I need to understand why.

The linked web push allowlist is hard coded because there are only 2-3 browsers out there and web push is used to push notifications to the browser. The browsers decide what URLs they register. So what web push URLs do we need to support here?!

@binwiederhier commented on GitHub (Mar 17, 2026): I struggle to understand the use case entirely. I'm more than happy to implement thongs but I need to understand why. The linked web push allowlist is hard coded because there are only 2-3 browsers out there and web push is used to push notifications to the browser. The browsers decide what URLs they register. So what web push URLs do we need to support here?!

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@p1gp1g commented on GitHub (Mar 17, 2026):

There are 2-3 main browsers, but many smaller ones, some of them allow self-hosting the push server.

A proper way to manage this is to not use an allow-list, but to deny post requests to unauthorized IP instead - cf the go code I shared earlier

@p1gp1g commented on GitHub (Mar 17, 2026): There are 2-3 main browsers, but many smaller ones, some of them allow self-hosting the push server. A proper way to manage this is to not use an allow-list, but to deny post requests to unauthorized IP instead - cf the go code I shared earlier

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@binwiederhier commented on GitHub (Mar 17, 2026):

Understood. The "proper" way is debatable. I have worked really hard to not allow any http requests to other servers from the ntfy server, because it can be a potential attack vector (not just for private IPs). I don't really want ntfy.sh to reach out to random other servers.

I'll likely add an allowlist for this then. What browsers can this be tested with?

How is this related to UP? Web push isn't used for UP yet. Or is it and I forgot?

@binwiederhier commented on GitHub (Mar 17, 2026): Understood. The "proper" way is debatable. I have worked really hard to not allow any http requests to other servers from the ntfy server, because it can be a potential attack vector (not just for private IPs). I don't really want ntfy.sh to reach out to random other servers. I'll likely add an allowlist for this then. What browsers can this be tested with? How is this related to UP? Web push isn't used for UP yet. Or is it and I forgot?

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@p1gp1g commented on GitHub (Mar 17, 2026):

Yep, the other issue may be a DOS amplification on some app, but it doesn't apply to ntfy as an event can't trigger push notifications from multiple server at once. This issue is resolved by another mechanism: during the registration of the push endpoint, the server sends a token the client must validate before sending the other push notifications. So we know it is a valid push server. If an attacker changes their push server to a targeted server, it would fail during TLS negociation, and the server is usally cached as unreachable at this moment

@p1gp1g commented on GitHub (Mar 17, 2026): Yep, the other issue may be a DOS amplification on some app, but it doesn't apply to ntfy as an event can't trigger push notifications from multiple server at once. This issue is resolved by another mechanism: during the registration of the push endpoint, the server sends a token the client must validate before sending the other push notifications. So we know it is a valid push server. If an attacker changes their push server to a targeted server, it would fail during TLS negociation, and the server is usally cached as unreachable at this moment

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@wrenix commented on GitHub (Mar 17, 2026):

The Browser Fennec (on F-Droid patches here: https://gitlab.com/relan/fennecbuild) and IronFox (https://ironfoxoss.org/). Support the usage of UnifiedPush (for WebPush). So this Browser could use any UnifiedPush-Provider to implement WebPush (and with it any Domain/Server).

@wrenix commented on GitHub (Mar 17, 2026): The Browser Fennec (on F-Droid patches here: https://gitlab.com/relan/fennecbuild) and IronFox (https://ironfoxoss.org/). Support the usage of UnifiedPush (for WebPush). So this Browser could use any UnifiedPush-Provider to implement WebPush (and with it any Domain/Server).

BreizhHardware commented

2026-05-07 00:29:57 +02:00

Author

Owner

@p1gp1g commented on GitHub (Mar 17, 2026):

And yes, UnifiedPush app server to push server is defined by web push (RFC8030, RFC8291, RFC8292) now for ~1.5 years.

2 of the browsers that allow to self-host the push server do it via UnifiedPush

@p1gp1g commented on GitHub (Mar 17, 2026): And yes, UnifiedPush app server to push server is defined by web push (RFC8030, RFC8291, RFC8292) now for ~1.5 years. 2 of the browsers that allow to self-host the push server do it via UnifiedPush

BreizhHardware referenced this issue

2026-05-07 01:02:25 +02:00

[PR #1057] [CLOSED] add templating for title and message fields #1504