DependencyTrack / DependencyTrack/dependency-track

Basic Auth in webhook notification seems broken

Open
#5,816 3 comments 0 reactions 0 assignees View on GitHub
defect in triage
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

My Setup:
[NTFY](https://github.com/binwiederhier/ntfy) and Dependecy Track behind [TRAFIK](https://github.com/traefik/traefik) reverse proxy and [AUTHENTIK](https://github.com/goauthentik/authentik). All deployed via docker compose.

Dependency Track: latest version (v4.13.6)
Ntfy: latest version (2.17.0)

I set up webhook notification as shown below:

Destination https://:exampleToken@ntfy.domain.tld/deptracker

Image

Testing these settings produces logs like following:

```
apiserver-1 | 2026-02-18 08:13:34,480 WARN [WebhookPublisher] Destination responded with with status code 403, likely indicating a processing failure (PublishContext{notificationGroup=NEW_VULNERABILITY, notificationLevel=WARNING, notificationScope=PORTFOLIO, notificationTimestamp=2026-02-18T08:13:34.430230305Z, notificationSubjects={component=Component[uuid=94f87321-a5d1-4c2f-b2fe-95165debebc6, group=null, name=componentName, version=componentVersion], projects=[Project[uuid=c9c9539a-e381-4b36-ac52-6a7ab83b2c95, name=projectName, version=projectVersion]], vulnerability=Vulnerability[id=INT-001, source=INTERNAL]}}) [principal=admin, requestUri=/v1/notification/publisher/test/{uuid}, requestId=059f27a8-272e-4d76-bb55-e3f07dbefe18, requestMethod=POST]
```

If I test my destination URL of ntfy like this, it works as expected
```
curl -d "Backup successful 😀" https://:exampleToken@ntfy.domain.tld/deptracker
```

My assumption: Basic Auth is not supported by destination field.

Further Information:
Empty Username in Basic Auth => password used as token https://docs.ntfy.sh/publish/#access-tokens
NTFY Example
```
curl \
-u :tk_AgQdq7mVBoFD37zQVN29RhuMzNIz2 \
-d "Look ma, with auth" \
https://ntfy.example.com/mysecrets
```

### Steps to Reproduce

1.

### Expected Behavior

Notification will be accepted by NTFY Server, no 403

### Dependency-Track Version

4.13.6

### Dependency-Track Distribution

Container Image

### Database Server

PostgreSQL

### Database Server Version

17

### Browser

Google Chrome

### Checklist

- [x] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [x] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this defect was already reported

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.