Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

Problem on sending bulk pushes for real world apps

Open
  • Is something wrong?
#197 13 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

  • #234 by @ryancco — closed without merging

Assessment

Difficulty
4/5
Estimated time
3-5 days
Newbie friendliness
25/100
Issue type
Bug
Clarity
Needs clarification
Activity status
Stale
Tech stack
php
Domain
api, backend

Research direction

Start from the bulk flush path and the prepare/encrypt behavior described in the report. Reproduce a batch containing valid subscriptions and invalid public keys or tokens, then determine how failures are returned; done means valid pushes can proceed while invalid entries are identifiable for removal or handling.

Written by the indexing model from the issue text.

Description

NOTE: Please test in a least two browsers (i.e. Chrome and Firefox). This
helps with diagnosing problems quicker.

Please confirm the following:

  • [X ] I have read the README entirely
  • [ X] I have verified in the issues that my problem hasn't already been resolved

Setup

Please provide the following details, the more info you can provide the
better.

  • Operating System:
  • PHP Version: <7.2>
  • web-push-php Version:

Please check that you have installed and enabled these PHP extensions :

  • [X ] gmp
  • [ X] mbstring
  • [ X] curl
  • [ X] openssl

Please select any browsers that you are experiencing problems with:

  • [ X] Chrome
  • [X ] Firefox
  • [ X] Firefox for Mobile
  • [ X] Opera for Android
  • [X ] Samsung Internet Browser
  • [X ] Other

Please specify the versions (i.e. Chrome Beta, Firefox Beta etc).
All Versions

Problem

Please explain what behaviour you are seeing.

When we send bulk webpushes (lets say 500 webpushes in 1 flush call) if any of the publickey or token is wrong it fails for all webpushes. When you get endpoint info from the browser some people can see the URL that you use to save the data on server side and they can add whatever they want.

Lets say a hacker added millions of fake endpoint or wrong public key or tokens to your system. So you also have many valid subscription data. It's impossible to send WebPushes even to valid subscriber in this case. You must find wrong public keys or auth keys manually and you must delete them manually from your db. It's impossible if you have millions of subscribers data.

Expected

I think WebPush library shouldn't throw any exception on prepare or encrypt method. It can silently add some info to the result and when we get result we can see the error and eliminate these fake data by adding some code like we do for expired endpoints.

Another option is you can add some methods like validate_endpoint_data and we can control the data using this method before adding it to db.

Please explain what you expected to happen

Features Used

  • [ X] VAPID Support
  • [X ] GCM API Key
  • [X ] Sending with Payload

Example / Reproduce Case

Please provide a code sample that reproduces the issue. If there is a
repository that reproduces the issue please put the link here.

Other

Thanks :)

Dominant language
PHP
Stars
1.9k
Forks
312
No merged PRs in 30d

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from web-push-libs/web-push-php

All issues in web-push-libs/web-push-php

Similar issues

More PHP issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.