Login attempt with invalid authentication (websocket API)

Hi everyone,

I’ve recently migrated from HA 0.116.4 (on RPi4/Hassbian) to HA Core 2020.12.1 (on Intel NUC/Ubuntu).
My configuration for both HA and Nginx has remained the same, but my logfile is being flooded with invalid authentication attempts.

I’ve added debug logging for the HTTP component to get a little more insight, so I know that the attempts are coming from the Websocket API, but I don’t know which service/device is trying to authenticate with the API.

These are the entries in my logfile:

2021-01-04 08:57:50 DEBUG (MainThread) [homeassistant.components.http.view] Serving /api/websocket to 192.168.10.1 (auth: False)
2021-01-04 08:57:50 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from setup.ubnt.com (192.168.10.1)

I have since tried adding a trusted_networks auth provider, but to no avail:

- type: trusted_networks
  allow_bypass_login: true
  trusted_networks:
    - 192.168.10.1
    - 127.0.0.1
- type: homeassistant

It seems that two integrations are polling the API websocket every 5 seconds. One of them, I’ve worked out, is AppDaemon. The other, I’m still trying to figure out. I’m trying to work out why this worked flawlessly in my previous setup and doesn’t anymore.

Is anyone able to help me debug this further or solve it alltogether?

Thanks in advance!

After digging some more, I managed to figure out what was wrong with my AppDaemon config.
I did not update the Long Lived Access Token that AD uses to authenticate with HA.

So that leaves me to figure out which other integration might be missing an access token…

Any clues are greatly appreciated!

Turns out it was AppDaemon in both instances. AppDaemon on my old RPI4 setup was connecting over SSL to my new NUC. Once I stopped the AppDaemon service on my old RPi, the authentication errors stopped.

I figured it out by enabling debug mode for the websocket_api, which showed me which auth token was used for the failing authentication call.

This is my logger.yaml config

default: warning
logs:
  homeassistant.components.webhook: debug
  homeassistant.components.http: debug
  homeassistant.components.websocket_api: debug

Leaving this here so the next poor sob doesn’t spend 4 hours of his life debugging this issue.

4 Likes