One of my biggest ever pet peeves about Home Assistant is the authentication flow.
With most other self hosted or SaaS I use, when your browser session expires, it says “Session expired!” and sends you to the login page, which is very sensible. In Home Assistant, it thinks it’s failed logins, which it isn’t, and often bans the client, if enabled.
It is so bad that if the browser or companion app or plugin or API gets into a bad state, you usually have to reset your whole session because every browser reload hangs, or shows the “Cannot connect to Home Assistant” message (which is false and misleading, by the way), and eventually just returns 401. Then you have to SSH in, remove the ban, restart all of Core…huge pain.
Now that I’ve finished ranting, how can this be better?
- Why can’t it just log me out and send me to the login page? Basically, why can’t it work like most other pieces of software with authentication?
- Why is the “Cannot connect to Home Assistant” screen even a thing, as if the UI loads then it’s totally misleading?
- Why can’t I set certain IP addresses to be fully trusted and un-bannable?
I am thinking of filing a proper GitHub issue just on the “why can’t it just log me out” peeve alone. but I wanted to hear from the community first.