starred/ntfy

Fork 0

mirror of https://github.com/binwiederhier/ntfy.git synced 2026-05-09 08:26:00 +02:00

[GH-ISSUE #132] Web UI broken with topic that require auth #110

New issue

Closed

opened 2026-05-07 00:20:06 +02:00 by BreizhHardware · 6 comments

BreizhHardware commented

2026-05-07 00:20:06 +02:00

Owner

Originally created by @arminus on GitHub (Feb 6, 2022).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/132

Testing the WebUI at tho point - not quite sure I've set up everything correctly, here's my ACL:

❯ ./ntfy access
user arminus (admin)
- read-write access to all topics (admin role)
user * (anonymous)
- no access to topic mysecrets
- read-write access to all (other) topics (server config)

http://pi4:8085/mysecrets gives me this:

Recent notifications (cached for 12h): 
Invalid Date
undefined

I pushed something to the topic before I figured out I had to explicitly do a ./ntfy access everyone mysecrets deny for that topic.

Next: Wouldn't t be desirable to trigger a BasicAuth dialog for a deny topic?
Next: http://arminus:password@pi4:8085/mysecrets also didn't give me the topic contents?

Am I missing something here?

Originally created by @arminus on GitHub (Feb 6, 2022). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/132 Testing the WebUI at tho point - not quite sure I've set up everything correctly, here's my ACL: ``` ❯ ./ntfy access user arminus (admin) - read-write access to all topics (admin role) user * (anonymous) - no access to topic mysecrets - read-write access to all (other) topics (server config) ``` http://pi4:8085/mysecrets gives me this: ``` Recent notifications (cached for 12h): Invalid Date undefined ``` I pushed something to the topic before I figured out I had to explicitly do a `./ntfy access everyone mysecrets deny` for that topic. Next: Wouldn't t be desirable to trigger a BasicAuth dialog for a deny topic? Next: http://arminus:password@pi4:8085/mysecrets also didn't give me the topic contents? Am I missing something here?

BreizhHardware

2026-05-07 00:20:06 +02:00

closed this issue
added the
🪲 bug

server
labels

BreizhHardware commented

2026-05-07 00:20:06 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 6, 2022):

The web UI is intentionally broken and does not work with auth at all. I want to make a proper web UI (#111) and didn't want to invest in the old one at all for this.

I am on the road right now. I can look at the particular issue I'm more detail, and I'll answer your questions later.

Thank you very much for reporting this!!!

@binwiederhier commented on GitHub (Feb 6, 2022): The web UI is intentionally broken and does not work with auth at all. I want to make a proper web UI (#111) and didn't want to invest in the old one at all for this. I am on the road right now. I can look at the particular issue I'm more detail, and I'll answer your questions later. Thank you very much for reporting this!!!

BreizhHardware commented

2026-05-07 00:20:07 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 6, 2022):

One more note: you may want to set auth-default-access = deny-all if you want to only have one admin user.

@binwiederhier commented on GitHub (Feb 6, 2022): One more note: you may want to set `auth-default-access = deny-all` if you want to only have one admin user.

BreizhHardware commented

2026-05-07 00:20:07 +02:00

Author

Owner

@arminus commented on GitHub (Feb 6, 2022):

I am on the road right now.

hey, it's Sunday, don't sweat it!

@arminus commented on GitHub (Feb 6, 2022): > I am on the road right now. hey, it's Sunday, don't sweat it!

BreizhHardware commented

2026-05-07 00:20:08 +02:00

Author

Owner

@binwiederhier commented on GitHub (Feb 7, 2022):

@arminus

not quite sure I've set up everything correctly, here's my ACL:

If you're trying to lock down the ntfy instance to "only I can use it", then you have not set it up correctly. The phrase - read-write access to all (other) topics (server config) implies that you have not set auth-default-access = deny-all. There's an example here that shows how to set up a private instance: https://ntfy.sh/docs/config/#example-private-instance

http://pi4:8085/mysecrets gives me this: ...

As I said above, the Web UI is broken and is not expected to work. I will eventually work on a new web UI, and I didn't want to put in effort to make the old one work (though it'd likely not be all that hard). My apologies for that. I renamed the ticket to indicate that the web UI is broken.

Next: Wouldn't t be desirable to trigger a BasicAuth dialog for a deny topic?

I think the browser basic auth dialog is not great, because it doesn't allow you to login. I'm kinda angry with browsers that they don't make a standard login flow for basic auth ... I will build something proper with the new web UI. Again, sorry about breaking this.

Next: http://arminus:password@pi4:8085/mysecrets also didn't give me the topic contents?

Yeah the topic route (/mysecrets) is not expecting auth at all. It just serves the site and that's that. It's broken :-/

@binwiederhier commented on GitHub (Feb 7, 2022): @arminus > not quite sure I've set up everything correctly, here's my ACL: If you're trying to lock down the ntfy instance to "only I can use it", then you have not set it up correctly. The phrase `- read-write access to all (other) topics (server config)` implies that you have not set `auth-default-access = deny-all`. There's an example here that shows how to set up a private instance: https://ntfy.sh/docs/config/#example-private-instance > http://pi4:8085/mysecrets gives me this: ... As I said above, the Web UI is broken and is not expected to work. I will eventually work on a new web UI, and I didn't want to put in effort to make the old one work (though it'd likely not be all that hard). My apologies for that. I renamed the ticket to indicate that the web UI is broken. > Next: Wouldn't t be desirable to trigger a BasicAuth dialog for a deny topic? I think the browser basic auth dialog is not great, because it doesn't allow you to login. I'm kinda angry with browsers that they don't make a standard login flow for basic auth ... I will build something proper with the new web UI. Again, sorry about breaking this. > Next: http://arminus:password@pi4:8085/mysecrets also didn't give me the topic contents? Yeah the topic route (`/mysecrets`) is not expecting auth at all. It just serves the site and that's that. It's broken :-/

BreizhHardware commented

2026-05-07 00:20:08 +02:00

Author

Owner

@arminus commented on GitHub (Feb 7, 2022):

If you're trying to lock down the ntfy instance to "only I can use it"

I actually wanted to test both a secured and an unsecured topic on the same instance. I understand the trade off in regards to #111 - wish I could help, but my WebDev skills are still too much 2015 like and I just don't find the time to deep dive into modern frameworks to be able to start something from scratch :-/

@arminus commented on GitHub (Feb 7, 2022): > If you're trying to lock down the ntfy instance to "only I can use it" I actually wanted to test both a secured and an unsecured topic on the same instance. I understand the trade off in regards to #111 - wish I could help, but my WebDev skills are still too much 2015 like and I just don't find the time to deep dive into modern frameworks to be able to start something from scratch :-/

BreizhHardware commented

2026-05-07 00:20:08 +02:00

Author

Owner

@binwiederhier commented on GitHub (Mar 11, 2022):

Done as part of #111; will be released in the next release (soon)

@binwiederhier commented on GitHub (Mar 11, 2022): Done as part of #111; will be released in the next release (soon)