Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Triggering single event on multiple encrypted channel fails #383

Open
dopeh opened this issue Feb 21, 2024 · 1 comment · May be fixed by #386
Open

Triggering single event on multiple encrypted channel fails #383

dopeh opened this issue Feb 21, 2024 · 1 comment · May be fixed by #386

Comments

@dopeh
Copy link

dopeh commented Feb 21, 2024

In issue #334 a proposal was made to allow triggering one event to multiple encrypted channels in a single API call. This resulted in #337 being merged.

However as can be seen in the pull request, the payload is encrypted using the name of the first channel that's provided (see https://github.com/pusher/pusher-http-php/blob/master/src/Pusher.php#L365). The shared secret for the event is then derived using that channel name in https://github.com/pusher/pusher-http-php/blob/master/src/PusherCrypto.php#L126C50-L126C51. So basically the shared secret is channel-specific and will be used for encrypting the payload send to all channels.

I have verified on the client-side that the event is indeed sent to all encrypted channels, but only the first channel is able to decrypt the data, all other channels are unable to decrypt the data. So this method does not work and you still need to do one API call per encrypted channel.

@paragonie-security
Copy link

Opened a pull request #386 that should resolve this issue (and eliminate a limitation of Pusher if accpeted into each language implementation).

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging a pull request may close this issue.

2 participants