I’ve got this use case where I want to be able to give guests or employees limited access. Things like to open the garage door to the shop…
I’ve read a bunch of threads on guest access and not found anything quite like I want. Ideally the guest can access a URL and they get access to one specific dashboard. For employees I’d like the same, but ideally keep some track of who did what and when.
I’ve been using kiosk mode to secure my phones dashboard when it’s locked (android device control), but that works because you can’t modify the URL path to disable kiosk mode.
Tonight, I wondered if I could create a dashboard and use a reverse proxy to access just that dash, that might keep people from being able to append queries that break out of kiosk mode right? From a security/access control perspective I could do authentication on the reverse proxy. A downside to this is that HA would see everyone as one user, so there’s no logging about who did what if I had multiple users.
Just spit balling here, could that work and be “secure”? Any other ideas?
I create JavaScript webpage and linked it to HA API with auth token.
Page has “doorbell” and “open with code” button.
I created OTP sensor for each user. They can enter OTP to allow opening. This prevent sharing and requires time of use authorization. It also allows me to see who entered code to open
There is automation that verifies OTP code along with any other rules, like time of day limits, and executes appropriate action. In this case it either opens gate, sends image to me and rings bell or if wrong code it rings the bell and send notification.
Since the page only sends info to HA (the OTP code) there is no possibility of sidestepping this to open
Site send http post with OTP as data. This gets redirected by my proxy server to weblink with bearer token to send data to HA automation. I need to check if it is possible to retrieve the redirect link which would also mean grabbing bearer token but for now I’m not terribly concerned and actually more concerned about someone with access to the webpage spamming the doorbell
I will edit my first post with code. Worst case maybe someone can improve it. I’m no coder but can make useful junk every once in a while
I’m following you know, at least in concept. I’m happy to help trying to exploit it too.
In my case it’s only going to be exposed via secure WiFi, and highly unlikely any person connecting will have the background to realize and exploit a vulnerability, but… I’d rather prefer to keep it properly locked down.
alias: ACTION_OTPWebhookGateOpen
description: ""
trigger:
- platform: webhook
allowed_methods:
- POST
- PUT
- GET
- HEAD
local_only: false
webhook_id: webhook2
id: code
- platform: webhook
allowed_methods:
- POST
- PUT
- GET
- HEAD
local_only: false
webhook_id: webhook1
id: doorbell
condition: []
action:
- if:
- condition: trigger
id:
- code
- condition: template
value_template: "{{ (trigger.json) == (states.sensor.person_otp.state) }}"
enabled: true
then:
- service: switch.turn_on
target:
entity_id: switch.gate_switch_3
data: {}
enabled: true
- service: notify.mobile_app_myphone
data:
data:
entity_id: camera.frigate_gate03
message: The Gate was opened using Code
else:
- if:
- condition: state
entity_id: siren.doorbell_play_tone
state: "off"
for:
hours: 0
minutes: 0
seconds: 10
enabled: true
mode: single
EDIT
It’s not in this code but the else condition needs a then action. Should be simple enough to add. I deleted by mistake when sanitizing for posting here