The Push Notification Bug That Took Three Layers to Find
1:00 AM to 2:27 AM. One bug, three root causes, zero clean error messages. It started with a simple complaint: an admin sends a push notification, and the user never receives it. No crash, no red error in the console, nothing obviously broken. Just silence on the other end. That kind of bug is the most frustrating kind. Everything looks like it's working. The permission prompt shows up fine. The admin panel says "sent." And yet nothing arrives. By 1 AM, after a long day already spent on a fairly large project, this was the last thing left to fix before calling it a night. It turned into an hour and a half of tracing one silent failure into another. Layer One: The CSP Was Blocking the Fix Before It Could Even Start The first clue showed up in the browser console: a Content Security Policy violation, quietly blocking a script that OneSignal's SDK needed to complete its own initialization. The permission popup looked completely normal, so it was easy to assume the subscription step was working. It wasn't. The script that OneSignal used internally to finish setting up the subscription was being blocked by the site's own security headers. The fix was small: add the missing domain to the script-src directive. But finding it meant not trusting what the UI looked like it was doing, and instead reading the actual network requests line by line. Layer Two: "Sent" and "Delivered" Are Not the Same Thing Once the CSP was fixed, notifications appeared to send successfully. The API returned a success response, an ID was created, and the admin panel showed a "sent" confirmation. Except the user still got nothing. This turned out to be a subtler problem. OneSignal's newer API doesn't return a recipient count in that initial response, so a message could be "created" successfully by OneSignal's servers while still reaching zero actual devices. The code was treating message creation as proof of delivery, which is not the same thing at all. The fix involved polling OneSignal's delivery-s