Security Concerns in Novu: Preventing Unauthorized Notification Access

I'm a beginner using Novu, and I have a security-related question. An attacker only needs the

NOVU_APPLICATION_IDENTIFIER

NOVU_APPLICATION_IDENTIFIER

and

subscriberId

subscriberId

to listen to a victim's notifications, and both of these are easily obtainable because

NOVU_APPLICATION_IDENTIFIER

NOVU_APPLICATION_IDENTIFIER

is exposed on the client side, and subscriberId in SQL databases is often an incrementing number, making it predictable.

Novu's current security solution for this issue is to use

subscriberHash

subscriberHash

when connecting. However, an attacker can modify the client code to connect without including

subscriberHash

subscriberHash

since there is no configuration on Novu's host that enforces a requirement for

subscriberHash

subscriberHash

to be present when users connect.

Novu•14mo ago•

3 replies

Rot4tion

Security Concerns in Novu: Preventing Unauthorized Notification Access

I'm a beginner using Novu, and I have a security-related question. An attacker only needs the

NOVU_APPLICATION_IDENTIFIER

NOVU_APPLICATION_IDENTIFIER

and

subscriberId

subscriberId

to listen to a victim's notifications, and both of these are easily obtainable because

NOVU_APPLICATION_IDENTIFIER

NOVU_APPLICATION_IDENTIFIER

is exposed on the client side, and subscriberId in SQL databases is often an incrementing number, making it predictable.

Novu's current security solution for this issue is to use

subscriberHash

subscriberHash

when connecting. However, an attacker can modify the client code to connect without including

subscriberHash

subscriberHash

since there is no configuration on Novu's host that enforces a requirement for

subscriberHash

subscriberHash

to be present when users connect.

Security Concerns in Novu: Preventing Unauthorized Notification Access

Similar Threads

Security Concerns in Novu: Preventing Unauthorized Notification Access

Similar Threads

Similar Threads

Similar Threads