There is a way to do this but it is not well documented and only developers are familiar with it, I think in the next release or 2 it will be addressed in a easier way. For now I am keeping the api_passowrd for IFTTT , Tasker and other components that depend on it.
2 Likes
Yeh, because thatās one of the deciding factors on buying a car.
At the risk of giving this car analogy even more stage time,ā¦ imaging taking it in for service and when you get it back the only way to start the car is having to call the dealer for a pincode with no way of turning that off. Iād have questions.
3 Likes
But what is your problem then?
So to use @drbytes car analogy, youād rather buy a car with no locks on the doors and no need for a key for the ignition and sort those things out yourself later?
Obviously if you choose to secure your car differently then you can use āaftermarketā stuff, or you can just stick with what it comes with.
Same with homeassistant. If you donāt want to use the Auth system, take it off. If you want to use something different, code it up.
Donāt make it harder for everyone else just because you know best.
2 Likes
I really donāt see where that would be the case with 0.77. Would you care to explain without a car analogy?
Please examine the code in my thread:
I want to get my code to work with the new authentication system going forward, even if trusted_networks no longer work.
Iām not making it harder for anyone in here and I do not know best.
If that new security feature was in response to lots of that model being stolen due to a previous security flaw that was becoming well known amongst the local car theives and was provided for free by the dealer, Iād be frivkinā ecstatic.
Remind me of your address again? My new car isnāt arriving until the end of October so Iāll just borrow yours in the meantime. 
Iād love to, but Iām one of the thick people round here who uses homeassistant without being able to understand python, and therefore actually quite likes being offered free security upgrades without having to learn to code it myself 
3 Likes
For the Proxy users out there. If you are using Traefik, then you will want to add the following to the frontend configuration which is referencing you HomeAssistant backend
[frontends.homeassistant.headers.customrequestheaders]
x-ha-access = "YourP@ssw0rd!"Yeh but the previous security flaw lies mainly in not having common sense and leaving something as hass open and exposed to the internet. Thatās not a security flaw, thatās ignorance.
Listen, I know itās well intention by the developers but itās a bit of a record scratcher when an api suddenly changes and breaks stuff that has been chugging along nicely for ages without a way to easly turn it off.
That said, Iāve jumped the hoops and adapted my code but I couldāve been doing something more fun.
Iād like to leave a little note here. If you have a Wemo switch unplugged and explicitly set each Wemo switch in your config, none of your wemo plugs will work. It throws an error about not being able to find the one and then none work. I have 3 wemo switches and sometimes I unplug one. Previous HA versions never had a problem, now they do.
Nothing to add really, but I wanted to say thank you to the entire team for another great release. I started playing with HomeAssistant over two years ago and I never could have imagined what an integral part of my familyās life it would become. I know we could live without it, but we sure wouldnāt want to!
So, THANK YOU HASS TEAM!! Youāve really enhanced our lives.
9 Likes
Updated to 77.1. No issues thanks for the hard work devs, bootup times are faster aswell.
2 Likes
After the 0.77 upgrade, āCustom UIā icon_color There is a problem with the functionality.
Thank you team for amazing progress! I have all the users setup and logged, now waiting for the new iOS app and the functionalities to make different UI layouts based on the user, also very much liked the idea for attribution, so to know what was triggered by who, etc. would be also great to know who is currently using the UI / app, etc 
keep on the good work, thank you!
1 Like
Disagree. My microwave works just fine for someone who breaks into my house. I donāt give a crap if someone breaks into my wifi and can then turn on my stereo.
This mandatory change is completely anti user choice.
Having a web product that doesnāt force āsecurityā down my throat was one of the reasons I picked HA. This is a really annoying change in my opinion.
The constant breaking changes and half the time upgrades kill my whole system until I intervene has really soured me on HA over the last few months.
Iām going to be in 0.76 indefinitely at this point.
6 Likes
Well that didnāt work, and now Iām seemingly locked out of my system. I followed the prompt to create a user, then Iām presented with āYouāre about to give :8123/ access to your Home Assistant instanceā and it doesnāt accept the user/password I just set - āInvalid username or passwordā. It wonāt let me go back or forward. Absolutely no other changes were made. Any tips on how I can get back in?
1 Like
Try renaming your config/.storage folder to .storage.bak and restart HA.
1 Like
Thanks, but thatās made it worse. Now I get 403ād on every browser. The .storage folder did seem to recreate on the restart, but something else is going here.
Software that is basically free, and people always complain.
HA has security issues or iāve been hacked = HA devs responsibility to fix.
Devs implement better security = oh i dont like this, i never asked for it,
You have to wonder why the devs bother some days
17 Likes