Since I placed a state entity widget on my Android homescreen, I keep getting notifications in home assistant about invalid login attempts.
The ip address logged is the local ip of my ISP modem/router/gateway.
Log:
Blockquote
Logger: homeassistant.components.http.ban
Source: components/http/ban.py:129
Integration: HTTP (documentation, issues)
First occurred: 8 December 2023 at 19:02:22 (3 occurrences)
Last logged: 14:15:18
Login attempt or request with invalid authentication from 192.168.2.254 (192.168.2.254). Requested URL: ‘/api/websocket’. (Home Assistant/2023.10.2-11484 (Android 13; Mi MIX 2S))
Login attempt or request with invalid authentication from 192.168.2.254 (192.168.2.254). Requested URL: ‘/api/states/sensor.living_room_temperature’. (Home Assistant/2023.10.2-11484 (Android 13; Mi MIX 2S))
The widget does work though. Even though I catch it having a red mark on it from time to time. Which I assume means there is no connection. After opening and closing the HA app, the red mark goes away.
I have the exact same issue. Seems to happen when the device reconnects to the home Wifi, therefore reloading information of the state widgets. It seems like the widget tries to connect to the Home Assistant server, without success. Opening the HA app then solves the issue. But it happens again and again and again.
My configuration is using an external URL.
Logger: homeassistant.components.http.ban
Source: components/http/ban.py:129
Integration: HTTP ([documentation], [issues])
First occurred: December 27, 2023 at 7:09:00 PM (19 occurrences)
Last logged: December 27, 2023 at 10:11:22 PM
Login attempt or request with invalid authentication from 10.XXX.X.XXX. Requested URL: ‘/api/states/xxx’. (Home Assistant/2023.12.4-11898 (Android 9; SM-J330FN))
etc.
I have the same issue too. It happens about once a day, but with different intervals. It seems to be related to the widget on my homescreen. The warnings do not occur if I remove the widget.
I enabled debug logging on the component homeassistant.components.http and captured the following logs around the event.
2024-01-28 06:48:50.642 DEBUG (MainThread) [homeassistant.components.http.view] Serving /api/websocket to <ip> (auth: False)
2024-01-28 06:48:50.707 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from <hostname> (<ip>). Requested URL: '/api/websocket'. (Home Assistant/2023.12.4-11898 (Android 14; <device>))
2024-01-28 06:49:00.929 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/token to <ip> (auth: False)
2024-01-28 06:49:00.978 DEBUG (MainThread) [homeassistant.components.http.view] Serving /api/websocket to <ip> (auth: False)
2024-01-28 06:49:01.126 INFO (MainThread) [homeassistant.components.websocket_api.http.connection] [140639218829632] Initialized trigger
It gives a notification. Unfortunatly I just cleared them. The text is along the lines of the log message
Login attempt or request with invalid authentication from <hostname> (<ip>)
The next time it happens I’ll post the exact message. Additionally I have enabeled debug logging for homeassistant.components.websocket_api. Maybe that provides some additional information as well.
I am still having the notification errors. I guess you are asking for the guilty Android smartphone generating these failed connection attempt? I can try and get some logs next weeks from the guilty phone.
The errors have been happening intermittently (see attached image) for me and I was not able to capture log data from the app until now. I have logging for the invalid login notification from both the app as HA itself. I did remove some PII from the logs.
Daily count of invalid login errors since Jan 21th:
