HA notifications always exposed?

Configuration
1

Hey there,

I am using Frigate and been playing with the notifications.
I use a self hosted website for my ha instance. It works really nice. But the notifications always opens in Browser and are public accessible what I absolutly don’t want. Anyone with the link can watch the clips of my cameras. There has to be a more secure way to do this?

2

There isn’t no.

Someone would have to know the event id and camera name to access it.

They also only have a window that exists for as long as you keep recordings of events.

3

Okay, that is wild. So basically someone could webscrape my site and download everything of my occuring events. Is this different with Nabu Casa?

4

to be clear there are multiple options in the integration for this

  1. unauthenticated proxy can be disabled entirely so you must have an access token as part of the request
  2. there can be a timeout configured to only allow unauthenticated access to a specific event for the first X seconds that that event was created
5

see my above comment.

also, the IDs are made up of timestamps down to the millisecond and random string that is 6 characters in length, that would take a crazy amount of time to even guess one event ID

also to be clear it is implemented this way due to limitations in HA core

6

Alright thanks. Then I will try it with the access token and deleting combined.

7

Yes sorry I meant in the context of the blueprint. I also thought this was a PM not a thread.

You of course can not allow any external access. But the blueprint won’t work fully

1 Like