[GH-ISSUE #1282] 403 when requesting designated topics when auth deny-all is used #909

New issue

Closed

opened 2026-05-07 00:28:39 +02:00 by BreizhHardware · 2 comments

BreizhHardware commented

2026-05-07 00:28:39 +02:00

Owner

Originally created by @elyashivhazan on GitHub (Feb 23, 2025).
Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1282

🐞 Describe the bug
When enabling auth with deny-all the Public/designated topics dont work, when using a real user (not admin) the server is responding with 403, with a made up user the server is responding with 401.
The server should respond with 401 for unauthorized users but respond with true (json) when authorized.

💻 Components impacted
Using the designated topics

💡 Screenshots and/or logs

🔮 Additional context
Could be related to #1018 because i found that issue when trying to use this app

i have solved this issue by running:

ntfy access '*' "stats" ro
ntfy access '*' "announcements" ro

i hope this could be solved, honestly i have no idea if its on purpose (if it is pleases mention in the docs)

if you need more info i will gladly provide

Originally created by @elyashivhazan on GitHub (Feb 23, 2025). Original GitHub issue: https://github.com/binwiederhier/ntfy/issues/1282 :lady_beetle: **Describe the bug** When enabling auth with deny-all the [Public/designated topics](https://docs.ntfy.sh/publish/#public-topics) dont work, when using a real user (not admin) the server is responding with 403, with a made up user the server is responding with 401. The server should respond with 401 for unauthorized users but respond with true (json) when authorized. :computer: **Components impacted** Using the designated topics :bulb: **Screenshots and/or logs** :crystal_ball: **Additional context** Could be related to #1018 because i found that issue when trying to use [this app](https://flathub.org/apps/com.ranfdev.Notify) i have solved this issue by running: ``` ntfy access '*' "stats" ro ntfy access '*' "announcements" ro ``` i hope this could be solved, honestly i have no idea if its on purpose (if it is pleases mention in the docs) if you need more info i will gladly provide

BreizhHardware

2026-05-07 00:28:39 +02:00

closed this issue
added the
🪲 bug
label

BreizhHardware commented

2026-05-07 00:28:40 +02:00

Author

Owner

@wunter8 commented on GitHub (Feb 24, 2025):

I'm not exactly sure what you mean. Are you referring to the topics stats and announcements on a self-hosted instance? They don't exist by default. They are special topics on the ntfy.sh instance, but they aren't included on self-hosted instances/nothing is posted automatically to those topics on a self-hosted instance.

So, if you want people to be able to access those topics on your server, and you have default access set to deny-all, you'll need to allow read-only access to those topics like you did above

@wunter8 commented on GitHub (Feb 24, 2025): I'm not exactly sure what you mean. Are you referring to the topics `stats` and `announcements` on a self-hosted instance? They don't exist by default. They are special topics on the ntfy.sh instance, but they aren't included on self-hosted instances/nothing is posted automatically to those topics on a self-hosted instance. So, if you want people to be able to access those topics on your server, and you have default access set to `deny-all`, you'll need to allow `read-only` access to those topics like you did above

BreizhHardware commented

2026-05-07 00:28:40 +02:00

Author

Owner

@elyashivhazan commented on GitHub (Feb 24, 2025):

Hi, i didnt except for messages to be sent automatically but to behave as in the main server because some apps using them as checks with them.
I guess its the app problem so im going to close this issue.

I think it should be mentioned in the docs.

have a nice day

@elyashivhazan commented on GitHub (Feb 24, 2025): Hi, i didnt except for messages to be sent automatically but to behave as in the main server because some apps using them as checks with them. I guess its the app problem so im going to close this issue. I think it should be mentioned in the docs. have a nice day