The token does change. This is updated by the websocket. I think a way around this might be to replace the image with a placeholder when the socket disconnects or the user leaves the window/tab.
There may be a way of detecting whether the tab goes to sleep which I think is the issue, as well as disconnection. (although these might be one and the same)
I think the issue is all about timing with that 500ms or so that makes the image refresh
Yes, I have multiple camera previews in my lovelace UI, which get frequently used.
Yes. 4 cameras configured with generic camera config and h.264 RTSP->AVC streams using the streaming component. Some devices use the live view, some don’t.
How do I do that for reverse proxy? These notifications are crazy.
Hi, I ended up here as well… have 4 instances of HA. 2 production and 2 dev/test. In all 4 I have this.
I get is from mobile browser access, mobile companion access and desktop browser access… both via direct “internal”, and external access via nabu casa and as well reverse proxy logins.
If I add the local network as trusted I get other weird behaviour like I suddenly have to login randomly and the browser seems not to remember the session (likewise the app).
How can I get rid of the mostly annoying messages?
@reinder83 did you succeed in configuring Home Assistant for a reverse proxy as @frenck suggested? If so would you mind sharing what steps you took?
I’d love to get rid of these warnings. As I have IP banning set-up sometimes I lock myself out of my home assistant…
Here are some examples of the warnings I get:
Many people seem to be sufering from these kind of warnings as demonstrated by for example this post and this one but the topics don’t really contain pointers about how to go about solving the issue.
Yeah I did, the only difference is the IP addresses in the warnings are from the actual device instead of a docker IP, so im still getting those.
Could this have something to do with ad-blocker/adguard/trackers/ blocker etc. in browsers???
oh man… well at least it’s one step forward in terms of solving the actual problem.
I’m not too sure what I should add to my configuration.yaml to configure home assistant for reverse proxies.
I have added the following:
http:
use_x_forwarded_for: true
trusted_proxies:
- 172.30.33.7
The IP address I used here is the one that is mentioned in the Home Assistant errors and if I look in portainer that is indeed the internal adress used in docker.
But this is completely unrelated to the actual internal ip adresses I use here at home, which looks like 192.168.0.158 for example, so I wasn’t too sure whether I should really be placing some internal docker IP adress here that a normal user (that doesn’t start digging into the portainer add-on) is not even supposed to know about at all.
EDIT: I see someone has proposed here to add some instructions on precisely these questions in the NGINX Proxy manager documentation here: Include `use_x_forwarded_for` instructions in doc · Issue #109 · hassio-addons/addon-nginx-proxy-manager · GitHub
But it was automatically closed after having received to response.
I’m also having the same issue, I think it is something to do with the reverse proxy as I am using NginX proxy manager. I think the issue may be caused by token’s as the issue only seems to occur once the app is resting in the background and then is switched back to causing the authentication to fail? Although I don’t know how to confirm this. I think you guys probably have your proxy set up correctly because I’m getting failed login attempts with the correct IP’s from the device that is logging in.
If you guys aren’t getting the correct IP I can send my config.yml file however this won’t solve the login attempt failed issues.
Same issue. Near each time I open the app, there is this notification. I think it comes from the very Android phone I’m opening it on but I’m not sure… Very annoying.
Same issue here, happens every single time I open the Home Assistant app on Android. It gives my local address of the phone when I’m at home and my WAN IP when I’m not at home. So it seems like it’s not just confined to Reverse Proxy!
Login attempt or request with invalid authentication from ConorPhone.broadband (192.168.0.37). See the log for details.
Very frustrating as I’m one of those OCD people about notifications! 
I’m having this issue at the moment. I think it might be because of the camera entity related to the Xiaomi vacuum map extractor HACS integration.
I’ve also started noticing this after I updated to the xiaomi vacuum map card v2.0. Happens with companion app as well as browser on my laptop.
Nothing has substantially changed. I’m going on 3 years of these messages. Probably related to cameras.
Yes, I still get these messages every day. Probably related to tabs/devices going to sleep with camera panels open (not a reverse proxy issue). At this point I wonder if it’s more effective to just look for a way to disable these notices entirely.
Mine seem to be coming from the companion app mostly, but sometimes come from the browser if I hadn’t used the tab for a while. I’m guessing it’s something to do with refreshing the token.
It is to do with token for camera when picture-entity is used. When you are coming back to the page it still has an old token. I had to disable fail2ban because of this.
Sometimes you just have to live with it. As long as it’s an internal issue, just ignore it. At least that’s what I do. I would prefer the dev to focus on many other improvements required. Three years later, it should have been fixed if it could. I still enjoy the system, never mind the yellow annoying notification down the page.
Yeah I’ve just trained myself to ignore notifications altogether… which is fine until something important shows up there…