mozilla-services / autopush

Python Web Push Server used by Mozilla
https://autopush.readthedocs.io/
Mozilla Public License 2.0
217 stars 34 forks source link

Investigate client reports of invalid salt #1418

Open jrconlin opened 4 years ago

jrconlin commented 4 years ago

See https://github.com/mozilla/application-services/issues/3365

I get the feeling this may be a problem with the subscriber providing zero length or empty salts. Depending on the encryption format, these can be contained in the delivered message. I'm not sure if the server should filter these invalid messages out.