Urgent: Option NOT to Show Users on Logon Screen

Feature Requests
1

Security fix:
Add option NOT to show the list of users on the logon screen.
In some cases, users should not even be shown locally.
E.g. in my setup, HA is accessed via a proxy, so it considers ALL access internal,
showing the user list to EVERYBODY trying the URL from the Internet.

  • A serious security risk.
2

Add option NOT to show the list of users on the logon screen.

Already requested by

And it looks like an option is being added for release 2024.1.

This is a configuration problem. You need to properly configure X-Forwarded-For header in the proxy, and enable both detection of the header and trusted proxies in the HA configuration.

For example, I have this configured for my Traefik proxy in the docker network:

http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.18.0.0/24
1 Like
3

I can’t really help with the disablement of this feature, but if it is really that critical maybe you should roll back to the previous version.

4
5

All discussion around the new login page aside, if that is the case, you already have a security issue caused by a misconfigured/improper reverse proxy setup.

Make sure you pass along the X-Forwarded-For headers and set up the http integration as documented.

…/Frenck

6

Closing as a duplicate. See the second post in this topic for the place to vote and comment.