They would fix it by providing an auth header as well as a URL param, so if outdated requests are authenticated properly, it wouldn’t mind it.
OK. I just opened up Chrome “Inspect” and on my home page there is a picture I have that uses the API you mentioned. As I was looking at the, the token actually changed!!! And in the course of composing this, it has changed yet again…
<img src="/api/camera_proxy_stream/camera.local_picture?token=03acc92blah blah blah" alt="Preview of the Local Picture camera.">
The fact that the token changes itself, does that mean this particular camera is not the problem of login attempt failures?
Well it should change itself, but if it fetches the image, and forgets to get the latest URL means any camera could be the cause. Anything that displays the entity-picture could be the problem (including the entities tab).
I get these from my tablet running HADashboard, whenever HA is restarted.
Oh, and my dashboard does have a webcam image on it.
The token does change. This is updated by the websocket. I think a way around this might be to replace the image with a placeholder when the socket disconnects or the user leaves the window/tab.
There may be a way of detecting whether the tab goes to sleep which I think is the issue, as well as disconnection. (although these might be one and the same)
I think the issue is all about timing with that 500ms or so that makes the image refresh
1 Like
Yes, I have multiple camera previews in my lovelace UI, which get frequently used.
Yes. 4 cameras configured with generic camera config and h.264 RTSP->AVC streams using the streaming component. Some devices use the live view, some don’t.
How do I do that for reverse proxy? These notifications are crazy.
Hi, I ended up here as well… have 4 instances of HA. 2 production and 2 dev/test. In all 4 I have this.
I get is from mobile browser access, mobile companion access and desktop browser access… both via direct “internal”, and external access via nabu casa and as well reverse proxy logins.
If I add the local network as trusted I get other weird behaviour like I suddenly have to login randomly and the browser seems not to remember the session (likewise the app).
How can I get rid of the mostly annoying messages?
@reinder83 did you succeed in configuring Home Assistant for a reverse proxy as @frenck suggested? If so would you mind sharing what steps you took?
I’d love to get rid of these warnings. As I have IP banning set-up sometimes I lock myself out of my home assistant…
Here are some examples of the warnings I get:
- Login attempt or request with invalid authentication from a0d7b954-nginxproxymanager.local.hass.io (172.30.33.7). (Mozilla/5.0 (Linux; Android 11; AC2003 Build/RP1A.201005.001; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/89.0.4389.105 Mobile Safari/537.36)
- Login attempt or request with invalid authentication from 192.168.0.158 (192.168.0.158). (Mozilla/5.0 (Linux; Android 11; SM-A705FN Build/RP1A.200720.012; wv) AppleWebKit/537.36 (KHTML, like Gecko) Version/4.0 Chrome/89.0.4389.105 Mobile Safari/537.36)
Many people seem to be sufering from these kind of warnings as demonstrated by for example this post and this one but the topics don’t really contain pointers about how to go about solving the issue.
Yeah I did, the only difference is the IP addresses in the warnings are from the actual device instead of a docker IP, so im still getting those.
Could this have something to do with ad-blocker/adguard/trackers/ blocker etc. in browsers???
oh man… well at least it’s one step forward in terms of solving the actual problem.
I’m not too sure what I should add to my configuration.yaml to configure home assistant for reverse proxies.
I have added the following:
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.7
The IP address I used here is the one that is mentioned in the Home Assistant errors and if I look in portainer that is indeed the internal adress used in docker.
But this is completely unrelated to the actual internal ip adresses I use here at home, which looks like 192.168.0.158 for example, so I wasn’t too sure whether I should really be placing some internal docker IP adress here that a normal user (that doesn’t start digging into the portainer add-on) is not even supposed to know about at all.
EDIT: I see someone has proposed here to add some instructions on precisely these questions in the NGINX Proxy manager documentation here: Include `use_x_forwarded_for` instructions in doc · Issue #109 · hassio-addons/addon-nginx-proxy-manager · GitHub
But it was automatically closed after having received to response.
1 Like
I’m also having the same issue, I think it is something to do with the reverse proxy as I am using NginX proxy manager. I think the issue may be caused by token’s as the issue only seems to occur once the app is resting in the background and then is switched back to causing the authentication to fail? Although I don’t know how to confirm this. I think you guys probably have your proxy set up correctly because I’m getting failed login attempts with the correct IP’s from the device that is logging in.
If you guys aren’t getting the correct IP I can send my config.yml file however this won’t solve the login attempt failed issues.
Same issue. Near each time I open the app, there is this notification. I think it comes from the very Android phone I’m opening it on but I’m not sure… Very annoying.
2 Likes
Same issue here, happens every single time I open the Home Assistant app on Android. It gives my local address of the phone when I’m at home and my WAN IP when I’m not at home. So it seems like it’s not just confined to Reverse Proxy!
Login attempt or request with invalid authentication from ConorPhone.broadband (192.168.0.37). See the log for details.
Very frustrating as I’m one of those OCD people about notifications! 
5 Likes
I’m having this issue at the moment. I think it might be because of the camera entity related to the Xiaomi vacuum map extractor HACS integration.
1 Like
I’ve also started noticing this after I updated to the xiaomi vacuum map card v2.0. Happens with companion app as well as browser on my laptop.
1 Like
Nothing has substantially changed. I’m going on 3 years of these messages. Probably related to cameras.
1 Like
Yes, I still get these messages every day. Probably related to tabs/devices going to sleep with camera panels open (not a reverse proxy issue). At this point I wonder if it’s more effective to just look for a way to disable these notices entirely.
1 Like