Java向iOS Safari推送通知遇403错误（BadJwtToken）求助

API 探路者

2026-7-30

问题

我正尝试让Web Push API在我的应用与iOS Safari中正常工作，在Safari中可正常完成注册，但向端点发送请求时收到403错误，错误原因为BadJwtToken。我已验证Authentication请求头中的token有效，且推送请求代码在Chrome和Edge中运行完全正常。是否有人遇到过类似问题？以下是包含请求与响应的日志片段，恳请提供建议。目前我已尝试了所有能想到的办法。

2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "POST /QKmekz9T3h2DpblQXdmVpVJPWtR145PdK-WYRMt4zldrXBOGsnqLluGtB9PFehMfoTXASt2-8pTmnRzUB0P0XMMDgX-tWdgIvL1YptpQdI_pVB3EEsnbR0LUStq97BUMIrMG_yVI6eUYJVigQtVgq0Fcl0D8k7tt9U8WEBbLmFc HTTP/1.1[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Authorization: WebPush eyJ0eXAiOiJKV1QiLCJhbGciOiJFUzI1NiJ9.eyJhdWQiOiJodHRwczovL3dlYi5wdXNoLmFwcGxlLmNvbSIsImV4cCI6MTY3NzIxMzEyNSwic3ViIjoibWFpbHRvOiA8aW5mb0BtZHNnbG9iYWwuY29tPiJ9.7P42kj123WHHWk0AaRiFiIb1nTx1GaeaY3xmDWJbD3tlNQn_Rxw-jZPZOzxb1YeN7y2qWO9qoSIAg22_SwZuOQ[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Content-Encoding: aesgcm[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Encryption: salt=ski4AOi0Xc5HCo2zvuzDfg[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "TTL: 2419200[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Crypto-Key: dh=BGLGnvvc-_jNZuHicms4eBijG7flOSUXHAte5GF2GtEQ1viZoL_NlzakYJBGMJrHHEbuxr76mPh8mAF0fZ2KFCo=;p256ecdsa=BKjlmDj7I5JkC3I2clsddfl7rklur8OIIx8_EKvDfpdrebwKRebZChSCIqKp64nkkyq4IWpUlVoDQ2CKK4axUjo[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Content-Type: application/octet-stream[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Content-Length: 202[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Host: web.push.apple.com[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "Connection: Keep-Alive[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "User-Agent: Apache-HttpAsyncClient/4.1.4 (Java/1.8.0_362)[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "[
][
]"
2023-02-23 16:32:05.882 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 >> "[0xffffffc6][0x8]1_[0xfffffff1][0xffffffaa][0x8]1m[0xfffffff3][0xffffffd9]0:[0xffffffd8][0x1d]2Y[0xffffff9c][0xffffffae][0x8][0xfffffffe]gVs[0xffffffec][0xffffffcd]~[0x15][0xffffff8e][0xc][0xfffffff7][0xffffff83][0x12]B[0xffffffcc]y[0xffffffd8][0xffffff8d]}C{mCL[0xffffffee]0Z[0xffffffc3][0xffffff9a])20[0xffffffc8]G[0xffffffdb]<t[0x6]a[0xffffff84]q[0x0][0xffffffc8][0xffffffa0][0xffffffe3][0xffffff95][0xffffff82][0xffffffdf]3'[0xffffffeb][0xffffffbf][0xffffffa7]H$\1[0xffffffaf]E[0xffffffb4]0[0xffffffbe][0xb]3[0xffffffdf]W[0x5],[0xffffffed][0xffffffeb]dR[0xffffffd6][0xffffffc5]Mk[0xffffffc7][0xffffffbe][0x18]%[0xffffffd5]A[0xffffffec]~f[0xffffffd5][0xfffffff3](u[0xffffffc4]J{kKG[0xffffff8f]7NaZ<1:F@[0xf][0xffffff97][0xffffffca].K[0xffffffea][0xffffffb1][0xfffffffd][0xfffffff6][0xffffff9d][0xffffffc9][0x7][0xffffff86]r[0xffffff95]S[0xfffffff4][0xffffffba]3[0xffffffe7][0xfffffff8][0xffffffd0];[0xffffffce][0xffffffd1][0xffffffce][0xffffffe7][0xffffffd1][0xffffffa2][0xffffffa0][0xffffffba]Z[0xffffff80][0xffffffa6][0x2]X[0xffffff9c][0xffffff91][0xffffffda][0xffffff98][0x12][0xffffffda]z[0xffffffe0]q7[0xffffffa9]F[0x0][0xffffffe7]3R[0xffffff9d]M\v:xU[0xffffffa4][0xffffffa6][0xffffffdf];na[0x1c][0xffffffe1]>[0xffffff82](2[0xffffffcf]-![0xffffff83][0xffffffd7][0xffffffc9]"
2023-02-23 16:32:05.883 DEBUG 17412 --- [/O dispatcher 1] o.a.h.i.nio.client.InternalIODispatch    : http-outgoing-0 [ACTIVE] Request ready
2023-02-23 16:32:05.883 DEBUG 17412 --- [/O dispatcher 1] h.i.n.c.ManagedNHttpClientConnectionImpl : http-outgoing-0 10.154.0.20:56270<->17.188.172.94:443[ACTIVE][r:w][ACTIVE][r][NOT_HANDSHAKING][0][0][0]: Event cleared [w]
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] h.i.n.c.ManagedNHttpClientConnectionImpl : http-outgoing-0 10.154.0.20:56270<->17.188.172.94:443[ACTIVE][r:r][ACTIVE][r][NOT_HANDSHAKING][0][0][0]: 158 bytes read
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "HTTP/1.1 403 Forbidden[
][
]"
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "content-type: text/plain; charset=UTF-8[
][
]"
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "content-length: 24[
][
]"
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "apns-id: 3253F680-762D-BC6F-9218-CB0F250A9142[
][
]"
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "[
][
]"
2023-02-23 16:32:05.975 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.wire                     : http-outgoing-0 << "{"reason":"BadJwtToken"}"
2023-02-23 16:32:05.978 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.headers                  : http-outgoing-0 << HTTP/1.1 403 Forbidden
2023-02-23 16:32:05.978 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.headers                  : http-outgoing-0 << content-type: text/plain; charset=UTF-8
2023-02-23 16:32:05.978 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.headers                  : http-outgoing-0 << content-length: 24
2023-02-23 16:32:05.978 DEBUG 17412 --- [/O dispatcher 1] org.apache.http.headers                  : http-outgoing-0 << apns-id: 3253F680-762D-BC6F-9218-CB0F250A9142
2023-02-23 16:32:05.978 DEBUG 17412 --- [/O dispatcher 1] o.a.h.i.nio.client.InternalIODispatch    : http-outgoing-0 [ACTIVE(24)] Response received

解决方案建议

检查JWT的aud字段：iOS Safari Web Push要求aud必须严格为https://web.push.apple.com，不能包含任何额外路径或参数，确保生成JWT时该字段完全符合要求。
修正sub字段格式：日志中JWT的sub字段是mailto: <info@mdsglobal.com>，这里有多余的空格和尖括号，苹果要求sub必须是mailto:你的邮箱地址的纯格式，要改为mailto:info@mdsglobal.com，且邮箱需与苹果开发者后台配置的推送服务关联邮箱一致。
确认签名算法：苹果Web Push仅支持ES256算法，确保你使用的是苹果开发者后台获取的P8格式私钥生成JWT，不能使用其他签名算法。
验证JWT有效期：exp字段的时间戳需为当前UTC时间之后，且有效期建议不超过24小时，避免超时或提前过期。
检查Crypto-Key头部：确保p256ecdsa参数是与生成JWT的私钥对应的公钥，格式无编码错误或多余字符。
核对请求头格式：Authorization头必须严格遵循WebPush <JWT_TOKEN>格式，WebPush与token之间仅保留一个空格，无额外换行或空白字符。

内容的提问来源于stack exchange，提问作者Ken Casey