DependencyTrack / DependencyTrack/dependency-track
Basic Auth in webhook notification seems broken
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
My Setup:
[NTFY](https://github.com/binwiederhier/ntfy) and Dependecy Track behind [TRAFIK](https://github.com/traefik/traefik) reverse proxy and [AUTHENTIK](https://github.com/goauthentik/authentik). All deployed via docker compose.
Dependency Track: latest version (v4.13.6)
Ntfy: latest version (2.17.0)
I set up webhook notification as shown below:
Destination https://:exampleToken@ntfy.domain.tld/deptracker
Testing these settings produces logs like following:
```
apiserver-1 | 2026-02-18 08:13:34,480 WARN [WebhookPublisher] Destination responded with with status code 403, likely indicating a processing failure (PublishContext{notificationGroup=NEW_VULNERABILITY, notificationLevel=WARNING, notificationScope=PORTFOLIO, notificationTimestamp=2026-02-18T08:13:34.430230305Z, notificationSubjects={component=Component[uuid=94f87321-a5d1-4c2f-b2fe-95165debebc6, group=null, name=componentName, version=componentVersion], projects=[Project[uuid=c9c9539a-e381-4b36-ac52-6a7ab83b2c95, name=projectName, version=projectVersion]], vulnerability=Vulnerability[id=INT-001, source=INTERNAL]}}) [principal=admin, requestUri=/v1/notification/publisher/test/{uuid}, requestId=059f27a8-272e-4d76-bb55-e3f07dbefe18, requestMethod=POST]
```
If I test my destination URL of ntfy like this, it works as expected
```
curl -d "Backup successful 😀" https://:exampleToken@ntfy.domain.tld/deptracker
```
My assumption: Basic Auth is not supported by destination field.
Further Information:
Empty Username in Basic Auth => password used as token https://docs.ntfy.sh/publish/#access-tokens
NTFY Example
```
curl \
-u :tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2 \
-d "Look ma, with auth" \
https://ntfy.example.com/mysecrets
```
### Steps to Reproduce
1.
### Expected Behavior
Notification will be accepted by NTFY Server, no 403
### Dependency-Track Version
4.13.6
### Dependency-Track Distribution
Container Image
### Database Server
PostgreSQL
### Database Server Version
17
### Browser
Google Chrome
### Checklist
- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported
Contributor guide
Assessment
This issue has not been assessed yet.