Security when reverse proxy and webhook call from same server

Configuration
1

Hi all,

I try to call the webhook api from my nas synology suveillance station, unfortunately surveillance station cannot pass header for authantication, that the reasion why a add a trusted network. On this server i also have my nginx server for the reverse proxy to my home assistant.

After adding the bellow configuration in my config file i can now always bypass the login page.
I don’t if it’s because there is something wrong in my configuration or if it because my nginx server and the surveillance station is on the same server and trusted the reverse proxy server is not a good idea.

configuration.yaml

homeassistant:
  auth_providers:
   - type: homeassistant
   - type: trusted_networks
     trusted_networks:
       - XXX.XXX.XXX.10

http:
  base_url : https://xxx.xxx.com
  use_x_forwarded_for: true
  trusted_proxies: XXX.XXX.XXX.10

nginx conf :

server {
        listen 80;
        server_name xxx.xxx.com;

        location / {
            return 301 https://$host$request_uri;
        }
}

server {
        listen 443 ssl http2;
        server_name xxx.xxx.com;

        ssl_certificate /usr/...fullchain.pem;
        ssl_certificate_key /usr/.../privkey.pem;

        location / {
            proxy_pass                 http://XXX.XXX.XXX.6:8123;
            proxy_http_version         1.1;
            proxy_buffering            off;
            proxy_set_header           Host $host;
            proxy_set_header           Upgrade $http_upgrade;
            proxy_set_header           Connection "Upgrade";
            proxy_set_header           X-Real-IP $remote_addr;
            proxy_set_header           X-Forward-For $proxy_add_x_forwarded_for;
        }
}

Thanks in advance for your insight

G.

2

trusted_networks==anyone with this ip dont need to login


3

According to the documentation, the webhook endpoint does not require authentication. I did test calling a HA webhook from inside Synology Surveillance Station just recently, and found that information to be correct.

4

Thanks all for your answers.

In fact I was using the /api/event that required authentication and not the /api/webhook.
After switching the url it work like a charm …

Thanks again

1 Like