[GH-ISSUE #1663] Firefox Web Push: unexpected response (response_code=401) #1161

New issue

Open

opened 2026-05-07 00:30:42 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:30:42 +02:00

Owner

Originally created by @moll on GitHub (Mar 18, 2026).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1663

Hey,

Thanks for making Ntfy open-source and maintaining it.

I'm seeing the Web Push notifications failing on Firefox and haven't managed to track down why it happens. Maybe you've seen the same or know where to look.

First, this is with Ntfy v2.17 on Linux 64-bit with Firefox v148 on a self-hosted instance. Created new web push keys, enabled web push in Ntfy, enabled push in the browser, subscribed to a notification channel, and confirmed that there was a subscription present in the webpush SQLite database. Triggered a notification from another device (the mobile app in this case) and saw its delivery to the web push fail the logs. After that, as expected, the subscription gets removed from the web push cache as Ntfy probably considers it invalid.

In the logs, slightly anonymized: DEBUG Unable to publish web push message, unexpected response (message_body_size=125, message_event=message, message_id=ID123, message_sender=1.2.3.4, message_sequence_id=ID123, message_time=1773832676, message_user=u_ATXX, response_code=401, tag=webpush, ..., web_push_subscription_endpoint=https://updates.push.services.mozilla.com/wpush/v2/gAAAAAXXX, web_push_subscription_id=wps_XXX, ...

The trace log level doesn't log the response body either, so I'm not exactly sure what Mozilla's push service responds with the 401 response code.

After that line there's another warning line, but I presume that's just the debug message bubbling up and causing a 500 in Ntfy: WARN Unable to publish web push message (error=internal server error: unable to publish web push message, error_code=50004, http_status=500, message_body_size=125, message_event=message, ...)

I tested it on the hosted instance (https://ntfy.sh) a few minutes ago and there things seem to work. Unless it was something you fixed in the recent versions, though the release notes don't mention anything related to web push.

Checking about:serviceworkers on Firefox seems to nicely show the service worker for both my instance and ntfy.sh. One thing that's different from the hosted variant is that I'm running my instance on a non-standard HTTPS port. Without visibility or knowledge on how web push works, could that be the cause of some errors sending the push to Mozilla's service? I am using a WebPKI cert, so self-signed certs aren't involved either.

Thanks in advance!

Originally created by @moll on GitHub (Mar 18, 2026). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1663 Hey, Thanks for making Ntfy open-source and maintaining it. I'm seeing the Web Push notifications failing on Firefox and haven't managed to track down why it happens. Maybe you've seen the same or know where to look. First, this is with Ntfy v2.17 on Linux 64-bit with Firefox v148 on a self-hosted instance. Created new web push keys, enabled web push in Ntfy, enabled push in the browser, subscribed to a notification channel, and confirmed that there was a subscription present in the webpush SQLite database. Triggered a notification from another device (the mobile app in this case) and saw its delivery to the web push fail the logs. After that, as expected, the subscription gets removed from the web push cache as Ntfy probably considers it invalid. In the logs, slightly anonymized: `DEBUG Unable to publish web push message, unexpected response (message_body_size=125, message_event=message, message_id=ID123, message_sender=1.2.3.4, message_sequence_id=ID123, message_time=1773832676, message_user=u_ATXX, response_code=401, tag=webpush, ..., web_push_subscription_endpoint=https://updates.push.services.mozilla.com/wpush/v2/gAAAAAXXX, web_push_subscription_id=wps_XXX, ...` The trace log level doesn't log the response body either, so I'm not exactly sure what Mozilla's push service responds with the 401 response code. After that line there's another warning line, but I presume that's just the debug message bubbling up and causing a 500 in Ntfy: `WARN Unable to publish web push message (error=internal server error: unable to publish web push message, error_code=50004, http_status=500, message_body_size=125, message_event=message, ...)` I tested it on the hosted instance (https://ntfy.sh) a few minutes ago and there things seem to work. Unless it was something you fixed in the recent versions, though the release notes don't mention anything related to web push. Checking `about:serviceworkers` on Firefox seems to nicely show the service worker for both my instance and ntfy.sh. One thing that's different from the hosted variant is that I'm running my instance on a non-standard HTTPS port. Without visibility or knowledge on how web push works, could that be the cause of some errors sending the push to Mozilla's service? I am using a WebPKI cert, so self-signed certs aren't involved either. Thanks in advance!

BreizhHardware added the

🪲 bug

label

2026-05-07 00:30:42 +02:00

BreizhHardware commented

2026-05-07 00:30:43 +02:00

Author

Owner

@nihalgonsalves commented on GitHub (Mar 22, 2026):

I would regenerate the web push keys and double-check whether your origin is set correctly. My first guess would be that the origin doesn't match. For example if you rewrite the origin via a reverse proxy, it won't work.

For web push to work, your ntfy base-url and the origin of the site that requests the web push keys have to match. (The origin is basically https://ntfy.example.com- protocol, hostname including domain/subdomain, and port number - 443 implied here).

@nihalgonsalves commented on GitHub (Mar 22, 2026): I would regenerate the web push keys and double-check whether your origin is set correctly. My first guess would be that the origin doesn't match. For example if you rewrite the origin via a reverse proxy, it won't work. For web push to work, your ntfy `base-url` and the origin of the site that requests the web push keys have to match. (The origin is basically `https://ntfy.example.com`- protocol, hostname including domain/subdomain, and port number - 443 implied here).

BreizhHardware commented

2026-05-07 00:30:43 +02:00

Author

Owner

@Karotte128 commented on GitHub (Mar 30, 2026):

Same issue on my instance. Tested on Chrome + Safari. The base-url is correct. I tried regenerating the keys a few times, did not help.

@Karotte128 commented on GitHub (Mar 30, 2026): Same issue on my instance. Tested on Chrome + Safari. The base-url is correct. I tried regenerating the keys a few times, did not help.

BreizhHardware referenced this issue

2026-05-07 01:02:32 +02:00

[PR #1161] [MERGED] Updating Docs - configuration table, shoutrr, Scrutiny, etc #1529