search

web-push-libs / web-push

Web Push library for Node.js
Other
3.26k stars 305 forks source link

WebPushError: Received unexpected response code, statusCode: 400, UnauthorizedRegistration #237

Closed srodovinsky closed 7 years ago

srodovinsky commented 8 years ago

Hi,

I am sending a batch of about 15,000 web push notifications to my website subscribers. Only about half of them go out fine. Rest of the pushes fail with the following error:

{ [WebPushError: Received unexpected response code]
  name: 'WebPushError',
  message: 'Received unexpected response code',
  statusCode: 400,
  headers: 
   { 'content-type': 'text/html; charset=UTF-8',
     date: 'Wed, 05 Oct 2016 14:58:14 GMT',
     expires: 'Wed, 05 Oct 2016 14:58:14 GMT',
     'cache-control': 'private, max-age=0',
     'x-content-type-options': 'nosniff',
     'x-frame-options': 'SAMEORIGIN',
     'x-xss-protection': '1; mode=block',
     server: 'GSE',
     'alt-svc': 'quic=":443"; ma=2592000; v="36,35,34,33,32"',
     'accept-ranges': 'none',
     vary: 'Accept-Encoding',
     connection: 'close' },
  body: '<HTML>\n<HEAD>\n<TITLE>UnauthorizedRegistration</TITLE>\n</HEAD>\n<BODY BGCOLOR="#FFFFFF" TEXT="#000000">\n<H1>UnauthorizedRegistration</H1>\n<H2>Error 400</H2>\n</BODY>\n</HTML>\n' }

Would you be able to help me to resolve this one?

gauntface commented 8 years ago

Do you notice any pattern in the subscribers that fail? I.e. are they all for a particular origin like GCM or FCM?

Can you provide code for pushManager.subscribe() and how your sending notifications.

srodovinsky commented 8 years ago

Thanks for looking into it.

I don't see any pattern yet, but will continue to investigate. All the subscribers are from browsers Chrome and Firefox, so I would assume they are GCM subscribers.

I am using version 3.0.0 of the web-push library and my code looks like this:

    const webpush = require('web-push');
    const sub = {
            "keys" : {
                "auth" : "......",
                "p256dh" : "..........................................."
            },
            "endpoint" : "https://android.googleapis.com/gcm/send/............................................................."
    };
    const params = {
        title: 'Test title',
        message: 'Test message',
        icon: '/api/push/icon/' + campaignId, //icon served by my API
        tag: 'message-tag'
    };
    webpush.setGCMAPIKey('XXXXXXXXXXXXXXXX');
    webpush.sendNotification(sub, new Buffer(JSON.stringify(params), 'utf8'))
             .then(
                 function (data) {
                     return callback(null, data);
                 },
                 function (err) {
                     return callback(err, null);
                 }
             )
             .catch(function (ex) {
                 return callback(new Error(ex), null);
             }
         );

Please let me know if any additional information might be helpful

marco-c commented 8 years ago

All the subscribers are from browsers Chrome and Firefox, so I would assume they are GCM subscribers.

Firefox doesn't use GCM (but Autopush), new versions of Chrome don't use GCM (but FCM).

Please let me know if any additional information might be helpful

Does it happen all the time? Every time you send a push to 15000 people, ~7500 fail? It would be helpful if you could send us a list of the endpoints that are failing (without the UUID part, e.g. https://updates.push.services.mozilla.com/wpush/v1/ instead of https://updates.push.services.mozilla.com/wpush/v1/SOME_LONG_UUID).

Notice that push subscriptions expire, so this might just be caused by the expiration of the subscriptions. If it happens all the time, it's unlikely.

srodovinsky commented 8 years ago

Hi @marco-c, thanks again for looking into this issue. Yes, that's right, every time I try to send a notification, about half of the attempts fail with the 400 UnauthorizedRegistration error.

I am also looking into transitioning my GCM project into the FCM console - however I am not sure if that is totally necessary (please correct me if I am wrong ).

Here are the stats of my endpoints without the UUID parts, I have obtained them by running Map Reduce and applying key = endpoint.substr(0, endpoint.lastIndexOf('/')); to each endpoint.

{ 
    "key" : "https://android.googleapis.com/gcm", 
    "value" : 268
}
{ 
    "key" : "https://android.googleapis.com/gcm/send", 
    "value" : 21313
}
{ 
    "key" : "https://updates-autopush.stage.mozaws.net/wpush/v1", 
    "value" : 1
}
{ 
    "key" : "https://updates.push.services.mozilla.com/wpush/v1", 
    "value" : 469
}
gauntface commented 8 years ago

One minor thing to note: GCM is returned in Chrome if there is no applicationServerKey in the subscribe() call (which sounds like it'll be all the Chrome endpoints in this case).

Can you see if the endpoints that error if it's all GCM endpoints or a mix of both android.google.apis.com and update-autopush.stage + updates.push.services.mozilla.com.

Sorry for all the questions, just trying to narrow down if it's a GCM problem vs a problem where.

jrconlin commented 8 years ago

hrm. Unless you are working closely with the Autopush team at mozilla, clients should NOT be hitting https://updates-autopush.*.mozaws.net for any reason. That is a staging and test machine and is not guaranteed to be stable.

froodian commented 8 years ago

Anecdotally I've been seeing a lot of production users come in with updates-autopush endpoints recently.

jrconlin commented 8 years ago

The endpoint is in many cases determined by the User Agent. If it registers to the stage server, it gets back a stage endpoint. There were early releases of android that were incorrectly set to hit the stage box, but they should have been corrected in subsequent versions (48+ if I understand correctly).

froodian commented 8 years ago

I see, thanks for the clarification

marco-c commented 8 years ago

Looks like most of the errors are with https://android.googleapis.com/gcm/send. Given the large number of your subscribers, the numbers for the other endpoints might simply be expired subscriptions.

@srodovinsky, is the error the same with Autopush? Could you check if the errors are different for the different domains?

jeltok commented 7 years ago

I guess I will just delete the subscriptions that give me that 400 error for now, and see if that happens again in the future.

vkammerer commented 7 years ago

Should this issue have been closed?

I have been seeing the same erratic behaviour yesterday and today, with FCM sometimes sending the push notification, and sometimes returning the same error code as here above... Right now it has been down for at least an hour, even though it works fine with FF....

I am sending a request with an endpoint to

https://fcm.googleapis.com/fcm/send/ENDPOINT

I tried regenerating keys, unregistering workers and clearing the cache to get a whole new fresh start, but it just won't do, and I still get the following error returned by webpush.sendNotification()

{ WebPushError: Received unexpected response code
    at IncomingMessage.<anonymous> (/Users/vincentkammerer/Web/vkammerer/communauto/automobile-superpowers/node_modules/web-push/src/web-push-lib.js:274:20)
    at emitNone (events.js:91:20)
    at IncomingMessage.emit (events.js:185:7)
    at endReadableNT (_stream_readable.js:974:12)
    at _combinedTickCallback (internal/process/next_tick.js:74:11)
    at process._tickCallback (internal/process/next_tick.js:98:9)
  name: 'WebPushError',
  message: 'Received unexpected response code',
  statusCode: 400,
  headers:
   { 'content-type': 'text/html; charset=UTF-8',
     date: 'Sun, 13 Nov 2016 16:56:51 GMT',
     expires: 'Sun, 13 Nov 2016 16:56:51 GMT',
     'cache-control': 'private, max-age=0',
     'x-content-type-options': 'nosniff',
     'x-frame-options': 'SAMEORIGIN',
     'x-xss-protection': '1; mode=block',
     server: 'GSE',
     'alt-svc': 'quic=":443"; ma=2592000; v="36,35,34"',
     'accept-ranges': 'none',
     vary: 'Accept-Encoding',
     connection: 'close' },
  body: '<HTML>\n<HEAD>\n<TITLE>UnauthorizedRegistration</TITLE>\n</HEAD>\n<BODY BGCOLOR="#FFFFFF" TEXT="#000000">\n<H1>UnauthorizedRegistration</H1>\n<H2>Error 400</H2>\n</BODY>\n</HTML>\n' }

Help much appreciated :)

jrconlin commented 7 years ago

Hrm. The fact that you're getting a 400 with that body feels a bit odd. https://firebase.google.com/docs/cloud-messaging/send-message defines the sorts of message responses you should see, including the error content.

That makes me think that this may be a credential problem. FCM is not GCM. The systems use completely different credentials, permissions, and a host of other attributes from what I can tell. If calls to the exact same endpoint with the exact same credential set produce the above error, then there may be a bug in FCM.

Sadly, I don't have any more knowledge of the GCM/FCM system, and can't really offer more help than what you could do yourself. I would try to collect up as much info as you can from your logs to see if there may be a pattern to the 400 responses.

vkammerer commented 7 years ago

I can confirm that this seems to be a problem coming from the FCM service, as it started working again yesterday, an hour after I posted this comment, without any change from my side... It's a bit annoying that the error messages aren't more explicit...

jrconlin commented 7 years ago

@vkammerer To be fair, when you do get proper error responses from FCM, they're pretty good. The problem is that sometimes things fall over or catch fire that aren't expected. As someone who works on the back end of things (Feel free to take that how you feel is best), I can sympathize. All of this is still fairly new, which means that there's a lot of unheard naughty words being said. Thanks for your patience and thanks for pointing out the bugs.

spock123 commented 7 years ago

FWIW, I am having precisely same issues with FCM. Getting the same error message when trying to send notifications (not using GCM, but with the VAPID keys)... while it works perfectly in Firefox.

Subscription: {"endpoint":"https://fcm.googleapis.com/fcm/send/ehnsCE9yuKg:APA91bFXtDj-ytYV-4CtVNrEBid…ui35iFfSsL36fwbfD4YRDLWFJifGeG8-eiO5jrya5UqoSUnplNKBCTQOIfjUpcgzgrv20zKOA6","keys":{"p256dh":"BFDb34eovZb2ds4huhgJSJDPz5egjSM4wzzh2H8Rtq8gj6TWJ6_jRTvsfccDbuCm7DS8W_MX9yMR__QQkmk8lwI=","auth":"DFq53NQwmMY21PLHN-1bdw=="}}

Sending from the server:


const webpush   = require('web-push');
const config = require( APPROOT + '/config/environment');

webpush.setVapidDetails(
  'whatever@gmail.com', config.push.public, config.push.private
);

const options = {

  vapidDetails: {
    subject: 'whatever@gmail.com',
    publicKey: config.push.public,
    privateKey: config.push.private
  },
  TTL: 60
}

module.exports = function(req, res) {

    const params = {
        title: 'Moosey Loosey',
        message: 'Test message',
        tag: 'message-tag'
    };

    const payload = new Buffer(JSON.stringify(params), 'utf8');
    const subscription = req.body;

    webpush.sendNotification( subscription, payload)

    .then( status => {
        console.log(status);

    })
    .catch( err => {

        console.log(err);

    })      
};

And getting same error from FCM:

{ name: 'WebPushError', message: 'Received unexpected response code', statusCode: 400, headers: { 'content-type': 'text/html; charset=UTF-8', date: 'Tue, 22 Nov 2016 13:42:34 GMT', expires: 'Tue, 22 Nov 2016 13:42:34 GMT', 'cache-control': 'private, max-age=0', 'x-content-type-options': 'nosniff', 'x-frame-options': 'SAMEORIGIN', 'x-xss-protection': '1; mode=block', server: 'GSE', 'alt-svc': 'quic=":443"; ma=2592000; v="36,35,34"', 'accept-ranges': 'none', vary: 'Accept-Encoding', connection: 'close' }, body: '\n\nUnauthorizedRegistration\n\n\n

UnauthorizedRegistration

\n

Error 400

\n\n\n' }



I lost 40% of my hair and about 10 years of my life trying to solve this.. , lmao
marco-c commented 7 years ago

This is basically the same issue of #254.

spock123 commented 7 years ago

@marco-c you are right.. I'm just frustrated nobody seems to know how and if it's solveable, or if we need to wait and see if it's an issue at the FCM endpoint service.

How does a company like Facebook, with 500 mio webapps with notifications, cope with this? I mean, it works in the Facebook web app in Chrome, so -something- must be working :)

ofavre commented 7 years ago

I got this when using an applicationServerKey in Chrome PushManager.subscribe() options while leaving the gcm_sender_id in my manifest. Removing gcm_sender_id solved the issue.

JakeCallery commented 7 years ago

@ofavre does it still happen to be working for you today? I am also getting the 400 error only in Chrome, Firefox works fine. I tried removing the gcm_sender_id from the manifest, but it didn't seem to change anything for me.

It the manifest.json used in the web app, or just with installed web apps?

ofavre commented 7 years ago

I've just tested and it works fine for both Chrome and Firefox. After removing gcm_sender_id (the resulting manifest is empty), I unregistered my service worker and probably cleared the notification permission, as I often do. I think it's necessary at least to unsubscribe (or remove the service worker altogether) so that a new, not senderId-bound subscription gets created.

I still link the manifest using <link rel="manifest" href="https://.../manifest.json"> in the head. Then I merely browse my web page, accept the notification permission and see the PushSubscription being sent with proper p256dh and auth keys, with applicationServerKey present in .options before serialization.

After that I send the following request:

POST /fcm/send/[…] HTTP/1.1
Host: fcm.googleapis.com
User-Agent: Go-http-client/1.1
Content-Length: […]
Authorization: WebPush eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.[…].[…]
Content-Encoding: aesgcm
Crypto-Key: dh=[…]; p256ecdsa=[…]
Encryption: salt=[…]
Ttl: 0

[…]

And receive the following response:

HTTP/2.0 201 Created
Content-Length: 0
Alt-Svc: quic=":443"; ma=2592000; v="35,34"
Cache-Control: private, max-age=0
Content-Type: text/plain
Date: Mon, 19 Dec 2016 10:24:36 GMT
Expires: Mon, 19 Dec 2016 10:24:36 GMT
Location: https://fcm.googleapis.com/fcm/0:1482143076403885%2f[…]
Server: GSE
X-Content-Type-Options: nosniff
X-Frame-Options: SAMEORIGIN
X-Xss-Protection: 1; mode=block
JakeCallery commented 7 years ago

Sorry guys, I'm an idiot. My endpoint string was being truncated in chrome's console. It is working for me now. Sorry for the confusion.

oninross commented 7 years ago

Can we open this issue again? It is working fine in FF but not in Chrome. I tried deploying it but it doesnt work at all even for FF. Any clues what is happening? Same error as the other developers here. See screenshot below. Not sure now if I am missing something or something is really wrong with the script

screenshot_020617_025553_pm

gauntface commented 7 years ago

That error suggests you aren't seeing a gcm API key but you're sending a request to a GCM endpoint.

On Sun, 5 Feb 2017, 19:56 Nino Ross Rodriguez, notifications@github.com wrote:

Can we open this issue again? It is working fine in FF but not in Chrome. I tried deploying it but it doesnt work at all even for FF. Any clues what is happening? Same error as the other developers here. See screenshot below. Not sure now if I am missing something or something is really wrong with the script

[image: screenshot_020617_025553_pm] https://cloud.githubusercontent.com/assets/2233813/22634292/62ebc8e2-ec7c-11e6-91e8-794d22d2d890.jpg

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/web-push-libs/web-push/issues/237#issuecomment-277581487, or mute the thread https://github.com/notifications/unsubscribe-auth/AAIh8NbMdCqH-thcy1qATFw8xBARU0dVks5rZpoGgaJpZM4KQUUk .

gauntface commented 7 years ago

Aren't setting*

On Sun, 5 Feb 2017, 20:00 Matt Gaunt, matt@gauntface.co.uk wrote:

That error suggests you aren't seeing a gcm API key but you're sending a request to a GCM endpoint.

On Sun, 5 Feb 2017, 19:56 Nino Ross Rodriguez, notifications@github.com wrote:

Can we open this issue again? It is working fine in FF but not in Chrome. I tried deploying it but it doesnt work at all even for FF. Any clues what is happening? Same error as the other developers here. See screenshot below. Not sure now if I am missing something or something is really wrong with the script

[image: screenshot_020617_025553_pm] https://cloud.githubusercontent.com/assets/2233813/22634292/62ebc8e2-ec7c-11e6-91e8-794d22d2d890.jpg

— You are receiving this because you commented. Reply to this email directly, view it on GitHub https://github.com/web-push-libs/web-push/issues/237#issuecomment-277581487, or mute the thread https://github.com/notifications/unsubscribe-auth/AAIh8NbMdCqH-thcy1qATFw8xBARU0dVks5rZpoGgaJpZM4KQUUk .

oninross commented 7 years ago

I got this in server.js

screenshot_020617_030542_pm

gauntface commented 7 years ago

You may be hitting a completely different error in that case.

The error message you are hitting is here: https://github.com/web-push-libs/web-push/blob/92a0882f21f1842fa386d2e3fcfc96eccfe46cd8/src/web-push-lib.js#L198

gauntface commented 7 years ago

@oninross Out of interest, if you set the key with webpush.setGCMAPIKey() does it work?

oninross commented 7 years ago

@gauntface sorry for the late reply, i got it to work already a days after that. Forgot what I did to make it work. But I'm facing a new issue here.

(node:29524) UnhandledPromiseRejectionWarning: Unhandled promise rejection (rejection id: 2): ReferenceError: callback is not defined

Like I said, it was working a few days back. I didn't change anything to the server. Probably just moved a few conditional statements, but that was it.

gauntface commented 7 years ago

@oninross for new issues please raise new issues - this issue has been closed for a long time now.

If you do open one, a longer stack trace will be necessary - sadly can't say anything regarding that issue because of lack of line numbers or files.

oninross commented 7 years ago

@gauntface, fair enough. Opened up a new one. I juat placed the issue here because the error evolved to the one i have mentioned.

By the way, that's the error coming out from the node server.

FilipChalupa commented 7 years ago

Watch out for Dev Tools console subscription.endpoint trim. image

J-Cake commented 6 years ago

Can confirm. As of now, issue is only present throught Chrome Canary.

Tested on Firefox v60.0.1, Chrome Canary v69.0.3483.0, MS Edge v42.17134.1.0, IE v11.112.17134.0, Opera v54.0.2952.41 and Chrome v67.0.3396.99

adamreisnz commented 2 years ago

I am experiencing this same issue now using web-push for Node, v3.4.5

There doesn't seem to be a reason or rhyme to which messages fail. We send out quite a lot of push notifications to various users but some of them have started to come back with this error.

Is there any way to further debug this or get some more details as to what is actually failing in the error message? The message "Received unexpected response code" is quite frankly very vague and doesn't tell us much.

Shivamprasad45 commented 2 months ago

Error sending notification, reason: WebPushError: Received unexpected response code at IncomingMessage. (C:\Users\Shivam\Desktop\webpush\webpush\node_modules\web-push\src\web-push-lib.js:378:20) at IncomingMessage.emit (node:events:531:35) at endReadableNT (node:internal/streams/readable:1696:12) at process.processTicksAndRejections (node:internal/process/task_queues:82:21) { statusCode: 403, headers: { 'content-security-policy-report-only': "script-src 'none'; form-action 'none'; frame-src 'none'; report-uri https://csp.withgoogle.com/csp/goa-520bfc14", 'content-type': 'text/plain; charset=utf-8', 'cross-origin-opener-policy-report-only': 'same-origin; report-to="goa-520bfc14"', 'report-to': '{"group":"goa-520bfc14","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/goa-520bfc14"}]}', 'x-content-type-options': 'nosniff', 'x-frame-options': 'SAMEORIGIN', 'x-xss-protection': '0', date: 'Fri, 02 Aug 2024 02:37:50 GMT', 'content-length': '89', 'alt-svc': 'h3=":443"; ma=2592000,h3-29=":443"; ma=2592000' }, body: 'permission denied: exp claim MUST NOT be more than 24 hours from the time of the request\n', endpoint: 'https://fcm.googleapis.com/fcm/send/[endpoint]' } ,I got this error any have soloution