UnauthorizedRegistration when sending a Chrome notification

akrylysov commented 6 years ago

The node cli app works fine:

web-push send-notification \
--endpoint="https://fcm.googleapis.com/fcm/send/<ENDPOINT>" \
--key="<KEY>" \
--auth="<AUTH>" \
--vapid-subject="mailto:x@x.com" \
--vapid-pubkey="<VAPID_PUBKEY>" \
--vapid-pvtkey="<VAPID_PRIVATEKEY>" \
--payload='{"version":"1"}'

but pywebpush fails using the same keys:

subscription_info = {
    'endpoint': 'https://fcm.googleapis.com/fcm/send/<ENDPOINT>',
    'keys': {
        'auth': '<AUTH>',
        'p256dh': '<KEY>',
    }
}
webpush(
    subscription_info,
    json.dumps({'version': '1'}),
    vapid_private_key='<VAPID_PRIVATEKEY>',
    vapid_claims={
        'sub': 'mailto:x@x.com'
    },
)

throws an exception:

Push failed: <Response [400]>: <HTML>
<HEAD>
<TITLE>UnauthorizedRegistration</TITLE>
</HEAD>
<BODY BGCOLOR="#FFFFFF" TEXT="#000000">
<H1>UnauthorizedRegistration</H1>
<H2>Error 400</H2>
</BODY>
</HTML>

jrconlin commented 6 years ago

Looks like this is more a Vapid issue than webpush. (There's a dependency issue.) https://github.com/web-push-libs/vapid/issues/62

jrconlin commented 6 years ago

Nope, I was wrong. Changing to VAPID RFC spec still fails for GCM. (Did fix up the raw key handler input finally)

For what it's worth, I'm not able to reproduce your problem. Using the demo page over on https://gauntface.github.io/simple-push-demo/ I'm able to send requests through, albeit, using a key from that page. What I can tell you is that js and python have slightly different key generation methods that sometimes produce incompatible keys. The difference happens in the cryptography component and fixing that is way outside of my skill set.

Try generating a different VAPID key and see if that works.

jrconlin commented 6 years ago

Closing, idle

web-push-libs / pywebpush

UnauthorizedRegistration when sending a Chrome notification #89