1486010 - [WebPush] Firefox keeps returning an expired endpoint

Status: UNCONFIRMED

(Core :: DOM: Push Subscriptions, defect, P2)

Description

[collimarco91]

User Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_13_6) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/11.1.2 Safari/605.1.15

Steps to reproduce:

I am the founder of Pushpad. Some time ago I subscribed to web push notifications here:
https://pushpad.xyz/demo

After many weeks of inactivity the subscription was expired and when I tried to send a notification to that endpoint it returned 410 Gone. This is the expected behavior. 

However the problem is that the browser continues to return the old (expired) endpoint every time you call pushManager.subscribe().

Note: I could fix the issue manually by revoking the permission and granting it again: that generated a new valid endpoint and notifications started working again

Tested on Firefox 61 on MacOS 10.13


Actual results:

The browser continues to return the old (expired) endpoint every time you call pushManager.subscribe().




Expected results:

The browser must return a valid endpoint (not expired) when you call pushManager.subscribe().

Comment 1

[Andrew McCreight [:mccr8]]

Andrew, do you know who might be able to look at this?

Comment 2

[Andrew Overholt [:overholt]]

Maybe JR?

Comment 3

[JR Conlin [:jrconlin,:jconlin]]

Huh. The autopush server should be returning a new URL. Since it's encoded, it should be distinct regardless of the values being used. I'm not sure, but this might be an issue with the local client caching the expired server URL. 

Lina might be able to provide more guidance.

Comment 4

[Lina Butler [:lina]]

Hi Marco! Could you please post:

* Your `dom.push.userAgentID` from about:config.
* If calling `pushSubscription.unsubscribe()`, followed by `pushManager.subscribe()`, also works, or if you need to revoke and grant the permission again?
* If you remember opening https://pushpad.xyz/demo between the time you subscribed to push, and when you noticed the endpoint was expired? (To rule out the quota kicking in).
* If you ever get a `pushsubscriptionchange` event when visiting the page?
* If this happened for any other push subscriptions, or https://pushpad.xyz/demo specifically?

One case where you might get an expired endpoint is if the subscription exceeds its quota...but then calling `subscribe()` will reject with an error, not return the old endpoint.

Another case is if the server deleted the endpoint without notifying the client. In theory, the server resets all `userAgentIDs` after dropping endpoints, though JR is right: if the client's and server's list of channels doesn't match, we'll end up with problems.

Thanks!

Comment 5

[collimarco91]

> * Your `dom.push.userAgentID` from about:config.

I don't know if I can post it publicly, so I have sent it to your email address ([e-mail])

> * If calling `pushSubscription.unsubscribe()`, followed by `pushManager.subscribe()`, also works, or if you need to revoke and grant the permission again?

The only thing that I have tried was to revoke / grant permission and it worked.

> * If you remember opening https://pushpad.xyz/demo between the time you subscribed to push, and when you noticed the endpoint was expired?

Yes, I have probably opened it other times. 

> * If you ever get a `pushsubscriptionchange` event when visiting the page?

I don't know and unfortunately I cannot reproduce that now. In any case note that that that page doesn't handle the pushsubscriptionchange (at the time of the bug). Instead, the page calls pushManager.subscribe every time you visit it, so that any new endpoint will be sent to the application server.

> * If this happened for any other push subscriptions, or https://pushpad.xyz/demo specifically?

I don't know. It seems that it has happened once for that specific subscription.

> One case where you might get an expired endpoint is if the subscription exceeds its quota...but then calling `subscribe()` will reject with an error, not return the old endpoint.

No, I am 100% sure that it was not raising an exception and that the old subscription / endpoint was returned.

Comment 6

[collimarco91]

I encountered this issue again on Firefox v68.8.1 for Android.

pushManager.subscribe() returns endpoints that are already expired.

Comment 7

[collimarco91]

This issue still affects Firefox v85 on Android...

Comment 8

[modi-zeichnung-05]

Still occurs in current releases (e.g. 116). pushsubscriptionchange works in general, but some clients get a probably old endpoint from PushManager.getSubscription. When you try to send a push-message to such an endpoint immediately you will get HTTP 410 errno 106 „No such subscription“. Clients may miss notifications and there seems to be no complete workaround. The whole process of expiration feels flawed and cumbersome, also because of bug 1497429.