search

mozilla-services / autopush

Python Web Push Server used by Mozilla
https://autopush.readthedocs.io/
Mozilla Public License 2.0
215 stars 34 forks source link

Investigate client reports of invalid dh #1417

Open jrconlin opened 3 years ago

jrconlin commented 3 years ago

See: https://github.com/mozilla/application-services/issues/3364

rfk commented 3 years ago

TL;DR the rust code doesn't handle quoted values when parsing the Encryption or Crypto-Key headers, ref https://github.com/mozilla/application-services/issues/3365

I think it's some to close this, unless you think it'd be worth autopush doing a bit of normalization here on the server side.

jrconlin commented 3 years ago

It's not a bad idea for the server to normalize values where appropriate. The opposite option would be to reject the request as invalid, but I think that might harm the library consumers more than the library authors.

It's a minor fix in any case, so we can at least consider it on the server. I still think the client should also normalize where and when possible in order to avoid future fragility issues.