Decode web push messages

[nneskildsf]

Hi

Thank you for this very nice repository. This has been really helpful to get started with Web Push with Fast API. I have created a minimal example which is a blend of the Python code in this repository and the HTML/JS from https://github.com/vppillai/simpleWebPushServer. My minimal example can demonstrate web push in a local web browser.

Perhaps it could be a useful example to include in this repository? If so you are welcome to grab the code and put it where you think it fits.

Anyways, what I want to ask about is listening to Web Push.
I would like to make a service which can subscribe to the /notification/subscribe endpoint and listen for messages. It is no problem to subscribe and to receive messages. However, I do get trouble when I need to decode the messages. I have managed to find one issue web-push-libs/encrypted-content-encoding#56 which deals with this but unfortunately the code does not run (raises cryptography.exceptions.AlreadyFinalized).

Do you have experience with decoding of the messages?

Br Eskild

[delvinru]

Hi, the idea with an example of a full-fledged application is great, I like it. I suggest just adding a link to your repo in the README as an example application.

[delvinru]

I have not personally encountered any errors, but I will study them further. If you describe the steps on how I can reproduce this behavior, it will greatly help and speed up the process.

[nneskildsf]

Hi @delvinru

I have created a Gist which should be illustrative.

Typically the notification service would be hosted by Google, Apple or Mozilla and it would set up a subscription to a web app when the user clicks a button on a website. The web app will then publish messages to the notification service which forwards them to the actual end user. In my case I want to host a service like that. My service should be capable of subscribing to the web app and receiving and decoding messages.

The gist contains the web-app code, much like what is in the readme on this repository, but also the notification service part. To this end the service defines a WebPushSubscription which it will submit to the web app, see
https://gist.github.com/nneskildsf/107f3623a5797473a014ef64e4548df3#file-web_notification-py-L21-L28.

How might I go about generating the parameters used to instantiate WebPushSubscription? From what I can tell the auth key is a generic secret string which is urlsafe_b64encoded and the p256dh should be generated like so:

receive_key = ec.generate_private_key(ec.SECP256R1(), default_backend())
p256dh = base64.urlsafe_b64encode(
    receive_key.public_key().public_bytes(
        encoding=serialization.Encoding.X962,
        format=serialization.PublicFormat.UncompressedPoint
    )
).strip(b'=')

Do you agree with this?

As I understand it, I should be able to decrypt the encrypted message that the web app sends to the notification service endpoint, see https://gist.github.com/nneskildsf/107f3623a5797473a014ef64e4548df3#file-web_notification-py-L54-L56. How?

I have a feeling that the solution is simple. I just need a little help getting there.

Br Eskild

[delvinru]

Ok, I'll take a look and come back with an answer later.

[nneskildsf]

Ok, I'll take a look and come back with an answer later.

Thank you so much. I have some interesting developments...

I just found out about the http_ece library and apparently it has a decode method which can take the receive_key and dh and decrypt the message. Gist is updated with my solution.

Do you agree with my approach? It's "scary" to handle the cryptography.hazmat so intimately.

[delvinru]

Hi, I looked at the details.

As far as I understand, you want to write your own server that will use the WebPush protocol to work with notifications.

Instead of the standard code on the client:

// Subscribe to push notifications
const subscription = await registration.pushManager.subscribe({
    userVisibleOnly: true,
    applicationServerKey: urlBase64ToUint8Array(publicVapidKey),
});

Are you going to craft this kind of json yourself and send it to the server?

{
    "endpoint": "https://your.server.com/webpush/someuniquelink",
    "keys": {
        "auth": "...",
        "p256dh": "..."
    }
}

At the same time, honestly, I don't understand the practical meaning of this:

• From my point of view, apple, google, mozilla, etc servers will be much more reliable;
• If you are afraid for the safety of the data you are sending, then elliptic curve cryptography is used for this purpose before sending the data. Of course, as long as the private key is secure.

And I highly doubt it will work the way you expect it to. Why?
Without calling the subscribe method, there will be no registration of the service (pushManager.subscribe and internal func), therefore there will be no push event, which is processed by the service worker.

Also, the server addresses in the code are simply hardcoded and I don't think they can be changed in general.

So far, honestly don't understand why to do all this at all.

In my practice, such scenarios have never occurred at all, but I do not rule out that there is some specific case that has just occurred to you.

[nneskildsf]

At the same time, honestly, I don't understand the practical meaning of this:

I want to integrate Web Push into a web service that users will interact with through a frontend in iOS/Chrome with the goal of pushing messages to end user devices. This is the use case that this library supports.

My web service is quite complicated so I will need to implement integration tests at some point to ensure that the Web Push stuff works as expected (and that it doesn't break). To this end it would be very beneficial if I could run a notification service capable of receiving Web Push messages send by my backend in exactly the same way that iOS/Chrome would do it as far as the backend is concerned. This would allow me to compare an expected list of sent Web Push messages to the list of messages actually received by the Web Push notification service.
This is my primary motivation to set up a notification service.

My secondary motivation is that my web service is used by real human users as well as by automated scripts. I would like for the automated scripts to (potentially) have access to the same notifications that human users get through iOS/Chrome. In this application the Web Push messages can be considered a sort of webhook.

Both of these use cases seem quite esoteric given that there's no current python library which does this. However, I have found other developers who ask about this type of functionality, so my idea might not be totally original :-).
See: mastodon/mastodon#28023, https://stackoverflow.com/questions/53231477/, https://stackoverflow.com/questions/61440571/, https://stackoverflow.com/questions/54955201/.

I've updates the Gist and I think it's final now. The NotificationService class in the Gist is basically capable everything I need at this time, so unless this is something you would consider accepting a PR for, then I will move on with it in my own project.
The Gist will stay but the https://github.com/Open-Pectus/Web-Push-Notification-Minimal-Example/tree/main repository will be removed eventually (say in a few months).

I appreciate all of your thought and consideration.

Br Eskild