Restrict Web Push delivery to public endpoints #654

Merged

timmy merged 1 commits from timmy/653-push-endpoint-egress-policy into main 2026-08-12 13:32:33 +00:00

Conversation 0 Commits 1 Files Changed 6

+190

timmy commented 2026-08-12 13:30:20 +00:00

Owner

Copy link

Copy source

Closes #653

Validates Web Push endpoints before persistence and immediately before delivery, rejects non-public DNS answers and unsafe URL authorities, disables redirects, and removes unsafe legacy subscriptions without contacting them.

Tests: python3 -m pytest tests/ -q (1311 passed).

Closes #653 Validates Web Push endpoints before persistence and immediately before delivery, rejects non-public DNS answers and unsafe URL authorities, disables redirects, and removes unsafe legacy subscriptions without contacting them. Tests: `python3 -m pytest tests/ -q` (1311 passed).

timmy added 1 commit 2026-08-12 13:30:21 +00:00

fix: restrict Web Push endpoint egress (Closes #653) 85043b4af6

timmy merged commit ea3194cdca into main 2026-08-12 13:32:33 +00:00

timmy referenced this issue from a commit 2026-08-12 13:32:35 +00:00

Merge pull request 'Restrict Web Push delivery to public endpoints' (#654) from timmy/653-push-endpoint-egress-policy into main

Sign in to join this conversation.

Reviewers

No Reviewers

Labels

Clear labels

P0

Drop everything

P1

High priority

P2

Medium priority

agent:nightprowl

Assignments routed to the LongCat NightProwl evaluation worker

backend

Backend service

ci

Continuous integration / actions

frontend

Frontend / UI

meta

Meta / planning

pages

Gitea Pages

template

Repo template / standards

No labels

Milestone

No items

No Milestone

Projects

Clear projects

No projects

Assignees

Clear assignees

nightprowl timmy (Timmy · the Wizard Mind) turdbot zephyrus-sparkborn (Zephyrus Sparkborn)

No Assignees

1 Participants

Notifications

Subscribe

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: stackchain/stackchain-dashboard#654