Changed password, now 403 Forbidden

Mobile Apps
1

I can always revert a VM backup of HAOS but I rather find out what caused this and avoid repetition. I paid for Nabu Casa, connected the iOS app using this, and changed my password as intended usecase within this app. This should not happen.

Using the HA iOS app, in HA using the menu I changed the password for my account. I checked the box to log out all clients, and it reported succes.

As expected I had to login again in the app, but it showed error “403 Forbidden”.
I expected this (and confirmed by documentation) to be due to a IP ban … but it still happens when I try to access it using a new IP.
Yet my wife’s Android app (already logged in with her non-admin user) continues to function properly.

Documentation 403 Forbidden (nabucasa.com) hints to a IP ban, and suggests configuration changes.
But

  • I dont see how a IP ban explains this for any new device I try, and
  • I do not understand how I am expected to do this when I run HAOS and have not enabled SSH in HA.
2

Turns out the HA is accessible using LAN ip.
I checked ip_bans.yaml and it was empty.

This reddit thread suggests it can be explained when router doesn’t like hairpinning (a request from the internal network interface connecting back to its external interface)

The odd thing is, I do not understand how a change of password results in loss of Nabu Casa connectivity.

So i went to doublecheck (again) in their console. It listed my HA as Connected. I clicked the link again (still the same link, i checked) and it showed a Splash page with “Connecting”. After a minute or so, it said “Could not connect”, and the page reloaded to show a “403 Forbidden”.

What can explain this?
Is it hairpinning on the router?

3

My router supports hairpin, and causality does not line up, so this is ruled out.

:face_with_raised_eyebrow:
But suddenly the Nabu Casa URL seems to work again. This is what I did, possibly explaining this:

  • In HA (via local IP) Settings under “Home Assistant Cloud” disconnect from Nabu Casa and reconnect.
  • Visit https://account.nabucasa.com/ and look for reconnect options on that end. There where none.
  • Wait over an hour.

:partying_face:
So for now it all works again. But what can explain this: still unknown.

If this is expected behaviour: the HA password change page (in iOS app) may want to mention this action is needed, and requires access via the local IP.