Going to add one more thing because I really want to contribute to the mindset of this idea. I don’t think TLS certificates is the right or wrong answer - but I do think the requirement is very important. The technical method is being dismissed (TLS), and the overall goal (security) is not being considered as a result.
Nabu is great but I don’t know how it works and the whole purpose of moving to HA was to get rid of cloud so I could take back control of things myself. Nabu is not a solution.
If Home Assistant wants adoption to go beyond low-security entities like light switches - it’s going to need to get serious about security. I have doors that it can unlock and air-conditioning units which I dare not expose on HA because it’s not secure enough. Username and password (and 2FA) are just one part of the 2 essential security requirements (something I know, and something I have). My 2FA is on the same phone I access HA - so cannot be classed as something I have.
A secure token that can be sent from the HA admin screen to the companion app for each device would satisfy “something I have”. It would do the same job as a cert (albeit less crude and more safe since it cannot be copied like certs can). In this case it also makes sense to have switch blocking access to HA by browsers from the external internet - users must use the companion app and its stored token for full security. This is what 2N and Axis (door entry security companies) did for their customers. I would happily pay a one-time fee to unlock this code. (but I am subscription exhausted - canceling as many as I can).
Voted by looks like no one care on IOS im also exausted of subscriptions PLEASE allow MTLS on ios devices this make no sense
10000% agreed with you, in my case im use vpn always on via wireguard, what is your solution for connection ? I just want to take ideas maybe im wrong but von wireguard always on is the secure options given the idea that i not want to pay nabucasa
Also upvoting this.
I guess giving us the ability to add custom headers with custom values to any request made by the app would be less hard to implement and at least offer us some more options to filter for at WAF level.
At least give us this option if mtls isn’t gonna happen.
The possibility to use mTLS authentication for the iOS compagnon app would be great! Voted!
I also use Immich they implemented it in their iOS app and that works great, maybe the home Assistant developers could have a look/talk there.
Hello
New user coming from Jeedom !
I put mTLS security level on my homelab on Cloudflare directly whitout checking before the basic : is mTLS supported os iOS app ?
I was sure this pretty common thing was… I was wrong 
It’s working on Android app, thanks god as my wife have android 
I will remain behind Tailscale exposed FQDN on my side until this basic feature implemented properly on the iOS app !
C’mon guys, home assistant is a door to user doors, please give them best security level 
Does HA as webapp support location update etc? I want to set this up for my parents as VPN
is to advanced for them and they have some automation depending on their phone location (home or not_home).
I could technically just us an input_boolean exposed to home-app in worst case.
I want to do the exact same thing. For my father who still uses an iPhone (although he was supposed to switch to a new android phone issued from work this year, which we have not heard any news about) and I want to automate notifications for when he leaves work because he forgets to message us a lot of the time. I resorted to just exposing HA through cf for now with admin account behind local access, but this still isn’t what I want.
Hey, you can do something like:
- Use safari webapp instead of home-assistant iOS app
- Enable mTLS since it’s just a website
- Use Apple home for automation, expose a input_boolean or something else from home-assistant to Apple Home and let Apple Home adjust this switch based on his location
- Do whatever you want with the input_boolean that gets updated based on location
Or since you use Cloudflare, you could use Cloudflare WAF and limit it to certain ASN (ie his mobile phone provider) and other rules that would limit the exposure greatly. I do this (for my parents) instead of going webapp since the Cloudflare WAF removes a 99% of the unwanted connections. That combined with 2FA should be good enough.
If you set up the good Cloudflare WAF rules, this should be secure enough. Not as mTLS but good enough.
I would see that we can Cloudflare Headers in the App. So we can use the CloudFlare Zero Trust Application with Service Tokens Allow Access.
Someone did a feature request but it get rejected. I can’t understand why… it’s a good way of protection and you can turn the feature on if you wanna use it.
Hi, everyone!
I played around a bit and got mTLS working, see PR below.
This code is by no means perfect, but might be a good starting ground, if the maintainers are willing to implement it, that is.
Would love developers to re-consider integrating this feature…
The technical method is being dismissed (TLS), and the overall goal (security) is not being considered as a result.
+10000…
I asked to make it possible to add headers in iOS app. I’m using Cloudflare zero trust and applications with policies. Wanna add f service token in the app so I can create a policy to allow connection to HA otherwise deny it.
Hopefully the recent PR by marius or the previous one by sevi might get a chance. Its not understandable why HA would not support the implementation of custom headers and/or mTLS.
People want to implement authentication and remote access on their own. Its not about, hey, you might subscribe the Nabu Casa service, its about the open platform itself.