Repeated connection attempts with invalid authentication results in IP ban

[dbrgn]

Home Assistant Android app version(s):

2024.1.5-12102

Android version(s):

13 (LineageOS)

Device model(s):

Pixel 4a

Home Assistant version:

2023.12.0

Last working Home Assistant release (if known):

n/a

Description of problem, include YAML if issue is related to notifications:

One of my two Android devices gets blocked repeatedly for trying to log in with invalid credentials. However, after deleting the IP bans file on the server (or switching the IP), it starts working again, so the credentials set in the companion app are valid.

Due to the repeated probles, I increased login_attempts_threshold to 50, but it still happens.

The other device, running GrapheneOS on Android 14, never gets blocked.

In the server log, I see the following:

Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.325 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.342 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.355 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.356 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.358 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.359 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.359 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.364 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.365 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.379 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.388 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.393 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.397 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.398 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.829 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.830 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.831 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:56 homeassistant homeassistant[598]: 2024-02-03 10:57:56.832 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.839 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.840 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.841 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.842 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.843 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.843 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.844 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.846 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.847 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.848 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.849 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.849 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.850 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.851 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.851 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.852 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.853 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.854 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.855 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.855 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.856 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.857 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.858 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.858 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.859 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.860 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.860 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:57 homeassistant homeassistant[598]: 2024-02-03 10:57:57.861 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.862 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.863 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.863 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.864 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.864 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.871 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.871 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.872 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.873 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.874 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.874 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.882 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.883 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.884 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.884 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.891 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.891 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.892 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.893 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.893 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.894 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.894 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.895 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.896 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.896 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.897 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.898 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.898 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.899 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.900 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.900 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.988 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:57.989 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.071 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.072 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.073 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.073 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.099 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.100 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.101 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.101 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.102 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.102 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.103 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.104 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.109 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 10.1.0.103 (10.1.0.103). Requested URL: '/api/websocket'. (Home Assistant/2024.1.5-12102 (Android 13; Pixel 4a))
Feb 03 10:57:58 homeassistant homeassistant[598]: 2024-02-03 10:57:58.110 WARNING (MainThread) [homeassistant.components.http.ban] Banned IP 10.1.0.103 for too many login attempts

It seems that the requested URL (with invalid credentials) is /api/websocket. (Initially I suspected it might have to do with too many widgets, but that doesn't seem to be the case.)

All requests happened within 3 seconds. Afterwards, I see no more requests.

In the morning, I used the app successfully. I only noticed the problem in the afternoon. Thus, it seems that these login attempts happened in the background.

If I change IP, it immediately works again.

I assume there must be some problem with some of the requests of the Android app. Might requests get sent with missing (or wrong) credentials? If this happens, could the error handling result in the same request being re-sent immediately, thus causing the server to be flooded with requests and the IP getting banned?

Companion App Logs:

Unfortunately the log only starts at 13:45:45, so it's probably not useful.

Here's the start of the log with a request error due to being blocked:

--------- beginning of main
02-03 13:45:42.576 13071 13071 D SensorReceiver: Received intent: android.net.wifi.STATE_CHANGE
02-03 13:45:42.586 13071 26104 D ServerConnectionInfo: localUrl is: false, usesInternalSsid is: false, usesWifi is: true
02-03 13:45:42.630 13071 11215 D ServerConnectionInfo: localUrl is: false, usesInternalSsid is: false, usesWifi is: true
02-03 13:45:42.631 13071 13108 I WM-WorkerWrapper: Worker result SUCCESS for Work [ id=57d1a46a-b48f-4d7f-ba01-17c7199d6493, tags={ io.homeassistant.companion.android.websocket.WebsocketManager } ]
02-03 13:45:45.593 13071 26104 D ServerConnectionInfo: localUrl is: false, usesInternalSsid is: false, usesWifi is: true
02-03 13:45:45.594 13071 26104 D ServerConnectionInfo: localUrl is: false, usesInternalSsid is: false, usesWifi is: true
02-03 13:45:45.657 13071 17134 D TrafficStats: tagSocket(107) with statsTag=0xffffffff, statsUid=-1
02-03 13:45:45.761 13071 26104 E SensorReceiver: Error while getting core config to sync sensor status
02-03 13:45:45.761 13071 26104 E SensorReceiver: io.homeassistant.companion.android.common.data.integration.IntegrationException: retrofit2.HttpException: HTTP 403
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at io.homeassistant.companion.android.common.data.integration.impl.IntegrationRepositoryImpl.getConfig(IntegrationRepositoryImpl.kt:533)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at io.homeassistant.companion.android.common.data.integration.impl.IntegrationRepositoryImpl$getConfig$1.invokeSuspend(Unknown Source:14)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlin.coroutines.jvm.internal.BaseContinuationImpl.resumeWith(ContinuationImpl.kt:33)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.DispatchedTask.run(DispatchedTask.kt:106)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.internal.LimitedDispatcher$Worker.run(LimitedDispatcher.kt:115)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.scheduling.TaskImpl.run(Tasks.kt:103)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.scheduling.CoroutineScheduler.runSafely(CoroutineScheduler.kt:584)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.executeTask(CoroutineScheduler.kt:793)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.runWorker(CoroutineScheduler.kt:697)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at kotlinx.coroutines.scheduling.CoroutineScheduler$Worker.run(CoroutineScheduler.kt:684)
02-03 13:45:45.761 13071 26104 E SensorReceiver: Caused by: retrofit2.HttpException: HTTP 403
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at retrofit2.KotlinExtensions$await$2$2.onResponse(KotlinExtensions.kt:53)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at retrofit2.OkHttpCall$1.onResponse(OkHttpCall.java:161)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at okhttp3.internal.connection.RealCall$AsyncCall.run(RealCall.kt:519)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1137)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:637)
02-03 13:45:45.761 13071 26104 E SensorReceiver: 	at java.lang.Thread.run(Thread.java:1012)
02-03 13:45:45.782 13071 26104 D ServerConnectionInfo: localUrl is: false, usesInternalSsid is: false, usesWifi is: true
...

Screenshot or video of problem:

Additional information:

Feel free to ask if you need more information.

[dshokouhi]

02-03 13:45:45.761 13071 26104 E SensorReceiver: Error while getting core config to sync sensor status
02-03 13:45:45.761 13071 26104 E SensorReceiver: io.homeassistant.companion.android.common.data.integration.IntegrationException: retrofit2.HttpException: HTTP 403

looks like a 403 error, please try logging out of hte app and logging back in, seems a token may have been revoked somewhere. If taht does not work then please tell us more about your networking setup.

[dbrgn]

looks like a 403 error, please try logging out of hte app and logging back in, seems a token may have been revoked somewhere.

I can try that, but after removing the IP ban, the app works fine for a few days, until the block hits again. So I do not think it is an expired token.

Additionally, if I turn on Wireguard VPN on that device, and thus access Home Assistant from a different internal IP, then everything works fine.

If taht does not work then please tell us more about your networking setup.

Home assistant runs on a dedicated computer with Debian, set up using the "Supervised" method. The devices are in the same network.

Because that machine is not accessible from the internet, I set up Wireguard VPN on my router. This allows me to access HA from a network-internal IP.

If there's anything else you need to know, let me know.

Edit: Ah, and just to make this clear as well: Home assistant sees every device by its actual IP (according to the logs). There's no reverse proxy that makes all devices visible under the same IP, or anything like that.

[dshokouhi]

ok the 403 error you periodically see is not something the app can solve, for the app we always send auth when needed but given you say you had VPN setup and it works you probably need to keep VPN on at all times. Keep in mind the app is designed to send continuous updates so it does need a constant connection in order to work properly.

[dbrgn]

The server says "Login attempt or request with invalid authentication". I would assume that this is either:

• Wrong credentials
• Missing credentials

Are there any other cases that could cause the server to return the "Login attempt or request with invalid authentication" error message in the log?

The code that sends authentication credentials is this one, right? Maybe I could add some logging to ensure that the same token is used everytime.

[dshokouhi]

The code that sends authentication credentials is this one, right? Maybe I could add some logging to ensure that the same token is used everytime.

thats just one of them but sure feel free to add logging, I would also try bypassing the VPN solution entirely and see if the issue still happens. Personally I dont see failed login attempts at all in my setup and I do not have a VPN setup.

[dbrgn]

thats just one of them but sure feel free to add logging

If you know of more cases in the code where requests to /api/websocket are authenticated, some pointers would be welcome 🙂

(Also, is there already a more permanent logging mechanism, than the extracting of logcat? Unfortunately by the time I notice the problem, the log is already truncated. But I guess I could just write those debugging logs to a file.)

[dshokouhi]

the app only gets the logs for the PID we are assigned and the OS can change that when it wants. We dont store long period of logs, an app like logcat reader can access historical logs kept on the device.

all of our auth and API logic is held in https://github.com/home-assistant/android/tree/master/common/src/main/java/io/homeassistant/companion/android/common/data

you may find it more helpful to load a debug version of the app by running a build of master in Android Studio. Debug builds will show more logging liek what type of authorization we are sending etc...

you can also run a debug build by downloading an APK from any PR in the github actions tab the APKs are held in the artifact that you need to download an extract

[dbrgn]

Great, thanks for the pointers! I'll let you know if I find out more.

First, I'll try clearing all data and reinstalling though.

[dshokouhi]

First, I'll try clearing all data and reinstalling though.

please follow our start fresh steps to ensure things are reset properly 😃

https://companion.home-assistant.io/docs/troubleshooting/faqs/#starting-fresh-with-the-android-app

[distante]

Following this topic. I have a similar issue, same endpoint, same warning, not that many requests though, I doesn't bans the ip.

I have the feeling it doesn't handle connection changes correctly. I have two networks in my home and I thing this happens when my phone toggles from one to another (sometimes passing first for the LTE connection).

[dshokouhi]

@dbrgn any luck with starting fresh?

[dbrgn]

@dshokouhi oh, thanks for the reminder and sorry for the late reply. The old phone (Pixel 4a) broke, and on the new phone (Pixel 8) that I have for about two weeks now, this issue did not occur anymore so far... So unfortunately I cannot provide any new information. From my side the issue could be closed, but @distante seems to have a similar issue.