Does not work with wns2-pn1p.notify.windows.com (Windows Notification Service)

[CetinSert]

Error

X-Wns-Error-Description: Zero or more than 1 crypto-key <dh> exist. Missing, duplicated or unrecognized field in salt field, dh Count:1 total count:2

Request

See the exact subscription, endpoint, and headers 👇🏻

{
      "message": [
        "push",
        {
          "subscription": {
            "endpoint": "https://wns2-pn1p.notify.windows.com/w/?token=BQYAAAAzkRaRJGmaVL4BeMXavxKoUNo1Q8m4OUUKSQ251R94mg2p%2bO3U%2f6StKGDs%2b1wGnDoAmcYSubYvnp2UTLDWDWBxqeR7ga5EOEut%2flaNJ1juo1OX1Xtddph3l7EDJ7yano8NdmcaHjpIMrCiQg07AYI6KxDNMiJ1vp8l9avmKmPx1cQtIR%2bMDePDVEgrLv5VeB%2fAwemyZUwIwanS2AYFFnjShPl6MeANYjzFICfMyt7vH%2fLOvQKk5N7PRtFBiHprSvxwalqKSFxYVFhlWUhQFS03GOJpOdY25w6%2fPygy79A6VsrBhXgZPBSw5fpkXoZDOU8%3d",
            "expirationTime": null,
            "keys": {
              "p256dh": "BJerTmhy8SaYITwQAOmngeCqZi3MpVPQ-ZTPQGTH0jbCyIsPubRZlfBWKFrKtYVzvHEISUuqLaLBbKdWjK2U46k",
              "auth": "EGOZZZEkmKqLlOkiVrVrYg"
            }
          },
          "payload": {
            "title": "2023-12-01T04:02:18.277Z",
            "body": "You are now subscribed to push notifications!"
          }
        }
      ],
      "level": "warn",
      "timestamp": 1701403338277
    },
    {
      "message": [
        "push",
        0,
        {
          "endpoint": "https://wns2-pn1p.notify.windows.com/w/?token=BQYAAAAzkRaRJGmaVL4BeMXavxKoUNo1Q8m4OUUKSQ251R94mg2p%2bO3U%2f6StKGDs%2b1wGnDoAmcYSubYvnp2UTLDWDWBxqeR7ga5EOEut%2flaNJ1juo1OX1Xtddph3l7EDJ7yano8NdmcaHjpIMrCiQg07AYI6KxDNMiJ1vp8l9avmKmPx1cQtIR%2bMDePDVEgrLv5VeB%2fAwemyZUwIwanS2AYFFnjShPl6MeANYjzFICfMyt7vH%2fLOvQKk5N7PRtFBiHprSvxwalqKSFxYVFhlWUhQFS03GOJpOdY25w6%2fPygy79A6VsrBhXgZPBSw5fpkXoZDOU8%3d",
          "headers": {
            "Encryption": "salt=h9jh4Xejoawr9rf33pg6JA",
            "Crypto-Key": "dh=BGBn_RCTXZCFAm9wp_FC9VXC64-CL3rOBGM3KNL5c-OU8Cq7tuX3UXgcdvy3y5nhg41C9yL4XpIKnRptit4Lqvg; p256ecdsa=BGSDfhpjPGYGwhDoUapYitSda3wkYKVW2DF8Vnp39kcq_IOLPOvJXa1T2VbMvS3Jg40U6WQL85ZAq-yZBTjpdIc",
            "Content-Length": "125",
            "Content-Type": "application/octet-stream",
            "Content-Encoding": "aesgcm",
            "Authorization": "WebPush eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3duczItcG4xcC5ub3RpZnkud2luZG93cy5jb20iLCJleHAiOjE3MDE0NDY1MzgsInN1YiI6IndzQHJ0Lmh0In0.l0vAyI8w0rMSR30Jx4djvJ0yyo1k95MXzcs77Y_TqAUUx4fhKEGq_hbeSQsLRBNH1xQ-Ts15aYQjewTCbhwbSA",
            "TTL": "60",
            "Urgency": "high"
          }
        }
      ],
      "level": "warn",
      "timestamp": 1701403338277
    },

[CetinSert]

if we use keyid in headers,

{
            "Encryption": "keyid=p256dh; salt=h9jh4Xejoawr9rf33pg6JA",
            "Crypto-Key": "keyid=p256dh; dh=BGBn_RCTXZCFAm9wp_FC9VXC64-CL3rOBGM3KNL5c-OU8Cq7tuX3UXgcdvy3y5nhg41C9yL4XpIKnRptit4Lqvg; p256ecdsa=BGSDfhpjPGYGwhDoUapYitSda3wkYKVW2DF8Vnp39kcq_IOLPOvJXa1T2VbMvS3Jg40U6WQL85ZAq-yZBTjpdIc"
}

we get a different error:

Www-Authenticate: bearer error="invalid_request",error_description="Malformed Crypto-Key Value"

The request works just fine in all other browsers except Edge (119) on Windows 11 (23H2) with/without keyid.

[CetinSert]

@alastaircoote – any ideas on this one?

[CetinSert]

@alastaircoote – any updates on this issue?

[alastaircoote]

Sorry, I haven't had any time, nor do I have a Windows machine to test this with. Hopefully eventually I will be able to but I'm not sure when.

[CetinSert]

@alastaircoote – this is analyzed and fixed in https://github.com/block65/webcrypto-web-push/pull/14/files#diff-9e3275d98ef58142ceebe2df4cf3da914a2e0d7e10c09ceab5a29180cb471d21

---

Minimal fix for webpush-webcrypto against wns2-… without regressions against iOS, Chrome, Firefox:

const { endpoint, headers, body } = await generatePushHTTPRequest({ applicationServerKeys, payload, target, adminContact, ttl, urgency }); if (0) console.warn('push', 0, { endpoint, headers });
headers['Crypto-Key'] = filter(headers['Crypto-Key']); // this fixes your library

function filter(str, include, ...keys) {
  const          pairs = str.split(';').map(pair => pair.trim());
  const  filteredPairs = pairs.filter(pair => { const key = pair.split('=')[0]; return include ? keys.includes(key) : !keys.includes(key); });
  return filteredPairs.join(';'); // ❌ '; ' vs ✔️ ';'
}

It looks like wns2-… does not like spaces around ;!

[CetinSert]

@alastaircoote – see the Edge fix here: https://github.com/alastaircoote/webpush-webcrypto/pull/6/files

[CetinSert]

o_O!?