Possible to have config option to send basic auth?

Mobile Apps Home Assistant Companion for Apple
1

I run HASS behind an nginx setup and ask for basic auth details from external connections to provide an additional layer of security.

2

I’d love to see this too as I also have my HomeAssistant instance behind nginx basic auth with no API password, which also lets me terminate SSL there.

3

I too would love this function. Right now I only can run the app on my own network :frowning:

4

Will try to add this soon.

5

Yes please add me to this request!

6

Any news on this? Still cant connect to HA with reverse proxy.

7

As a workaround put user:password in the URL - this should work. So e.g. https://user:[email protected]/ha/

8

I know this doesn’t resolve the issue, but in the meantime it’s probably better to use the iOS app than hold off due to security. I use an nginx reverse proxy with basic auth and fail2ban for my other web apps, but have auth disabled for Home Assistant in the meantime.

Home Assistant can handle IP banning itself and that definitely works for now.

http:
  base_url: !secret base_url
  api_password: !secret api_password
  ip_ban_enabled: true
  login_attempts_threshold: 5
  use_x_forwarded_for: True
  trusted_networks:
    - 127.0.0.1
    - ::1
    - 192.168.1.0/24
9

Sorry for negroposting, but this seems to still be a issue :frowning:

358141580_1731506440684857_8008563582432206504_n
358141580_1731506440684857_8008563582432206504_n1170×2532 55.5 KB

I believe that having basic auth would have protected against the March 2023 vulnerability, so I think this is VERY relevant still.

1 Like