trusted_network auth doesn't work when http trusted_proxies are configured

[okand]

The problem

I am trying to make trusted_network auth work when accessing Home Assistant from my LAN. Sometime in the past it used to work and then it stopped, this was so long ago that I can't really remember which version it happened with. Anyway, I've got visitors on the way and thought I should make an effort to make this work again as I think creating a guest-user is an ugly workaround.

If I don't set any http: config then trusted_networks works when accessing HA directly on its local IP and port, however this completely breaks my reverse proxy making it just say "400: Bad Request" whether I'm accessing the reverse proxy from the LAN or from the internet.

If I set the http: config as seen in my attached example then my reverse proxy works but if I click on the trusted networks login on the HA login page it just tells me "Login aborted: Your computer is not allowed.". This happens both if I go directly to the IP and port, or if I go through the reverse proxy.

I've got hairpin NAT configured in my router so when you access the external URL from inside my LAN it appears as if I'm accessing HA directly from my routers IP in the HA access logs (192.168.1.1), while I get my correct LAN IP (192.168.11.30) if I go directly to the IP and port HA is running on. There are no errors or anything useful that appears in the logs I think but I've attached them anyway. Are there any other components I should enable logging for that would help? Just setting everything to debug makes way too big of a mess I feel.

What version of Home Assistant Core has the issue?

2022.9.1

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant Container

Integration causing the issue

http

Link to integration documentation on our website

https://www.home-assistant.io/integrations/http#reverse-proxies

Diagnostics information

No response

Example YAML snippet

homeassistant:
  # Name of the location where Home Assistant is running
  name: ha
  # Location required to calculate the time the sun rises and sets
  latitude: !secret loc_lat
  longitude: !secret loc_lon
  # Impacts weather/sunrise data (altitude above sea level in meters)
  elevation: 35
  # metric for Metric, imperial for Imperial
  unit_system: metric
  # Pick yours from here: http://en.wikipedia.org/wiki/List_of_tz_database_time_zones
  time_zone: Europe/Stockholm
  # Auth stuff
  auth_providers:
    - type: homeassistant
    - type: trusted_networks
      trusted_networks:
        - 192.168.0.0/16
        - 172.16.0.0/12
        - 127.0.0.1
        - ::1

  # URL
  external_url: https://ha.domain.tld
  internal_url: http://192.168.11.31:8123
  # Customization stuffs
  customize: !include customize.yaml

# web ui and auth stuff
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 192.168.0.0/16
    - 172.16.0.0/12
    - 127.0.0.1
    - ::1

# logging
logger:
  default: critical
  logs: 
    homeassistant.components.http: debug

Anything in the logs that might be useful for us?

nuc :: ~ % docker logs -f homeassistant                                                                                                                        
s6-rc: info: service s6rc-oneshot-runner: starting
s6-rc: info: service s6rc-oneshot-runner successfully started
s6-rc: info: service fix-attrs: starting
s6-rc: info: service fix-attrs successfully started
s6-rc: info: service legacy-cont-init: starting
s6-rc: info: service legacy-cont-init successfully started
s6-rc: info: service legacy-services: starting
services-up: info: copying legacy longrun home-assistant (no readiness notification)
s6-rc: info: service legacy-services successfully started
[19:33:44] INFO: Home Assistant Core finish process exit code 100
[19:36:57] INFO: Home Assistant Core finish process exit code 100
[20:04:39] INFO: Home Assistant Core finish process exit code 100
[20:12:00] INFO: Home Assistant Core finish process exit code 100
[20:13:54] INFO: Home Assistant Core finish process exit code 100
[20:15:06] INFO: Home Assistant Core finish process exit code 100
[20:48:32] INFO: Home Assistant Core finish process exit code 100
[20:50:25] INFO: Home Assistant Core finish process exit code 100
[20:57:34] INFO: Home Assistant Core finish process exit code 100
2022-09-10 20:57:35.686 INFO (MainThread) [homeassistant.components.http] Now listening on port 8123
2022-09-10 20:57:38.386 DEBUG (MainThread) [homeassistant.components.http.view] Serving /api/websocket to 192.168.11.1 (auth: False)
2022-09-10 20:57:39.543 DEBUG (MainThread) [homeassistant.components.http.view] Serving /api/webhook/e4a613de1bc74f6253962913f2f11a7299c14d80cd84df71830d47cf97cf21cc to 40.74.19.186 (auth: False)
2022-09-10 20:57:49.493 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/providers to 192.168.11.30 (auth: False)
2022-09-10 20:57:49.670 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.30 (auth: False)
2022-09-10 20:57:52.628 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow/2e4e3ace0ca01464b2edca72c47a2a42 to 192.168.11.30 (auth: False)
2022-09-10 20:57:52.634 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.30 (auth: False)
2022-09-10 20:57:55.050 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.30 (auth: False)
2022-09-10 20:57:55.832 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.30 (auth: False)
2022-09-10 20:57:57.011 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.30 (auth: False)
2022-09-10 20:58:13.944 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/providers to 192.168.11.1 (auth: False)
2022-09-10 20:58:14.207 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.1 (auth: False)
2022-09-10 20:58:16.180 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow/026ea26a5a34c9629c1275c766e33c09 to 192.168.11.1 (auth: False)
2022-09-10 20:58:16.186 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.1 (auth: False)
2022-09-10 20:58:17.959 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.1 (auth: False)
2022-09-10 20:58:18.569 DEBUG (MainThread) [homeassistant.components.http.view] Serving /auth/login_flow to 192.168.11.1 (auth: False)

Additional information

No response

[probot-home-assistant]

http documentation
http source
_{^{(message by IssueLinks)}}

[probot-home-assistant]

Hey there @home-assistant/core, mind taking a look at this issue as it has been labeled with an integration (http) you are listed as a code owner for? Thanks!
_{^{(message by CodeOwnersMention)}}

[bdongithub]

Are you sure you've got the reverse proxy set up correctly? Trusted networks and an nginx reverse proxy are playing nicely in my setup, but I recall there being some hiccups when I set it up.

Make sure your trusted_proxies entry is the address of your reverse proxy (not the clients), and that it is properly configured to set the x-forwarded-for header. I needed both of those before trusted networks worked for me both through the proxy and directly—even if the reverse proxy address is contained in trusted_networks, it didn't work for me until it was setting the x-forwarded-for header properly so home assistant knew that it was being proxied from a trusted network.

Edit; snip from my yaml

http:
  use_x_forwarded_for: true
  trusted_proxies: 10.1.3.210

homeassistant:
  auth_providers:
    - type: homeassistant
    - type: trusted_networks
      trusted_networks:
        - 10.1.3.0/24
        - 10.1.2.0/24
        - 10.1.10.0/24
        - 172.16.0.0/12
        - 127.0.0.1
        - ::1

and nginx config:

location / {
        proxy_pass http://<HA server, FQDN redacted>:8123;
        proxy_set_header Host $host;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_no_cache 1;
        proxy_cache_bypass 1;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }

(nginx is running on 10.1.3.210)

[okand]

Right, but as I mentioned in the initial post. trusted_networks auth doesn’t work even if I skip the reverse proxy and go directly to the ip and port that home assistant runs on while I have the http: config in place. And without it the login page won’t even load over the reverse proxy.

I got all of 192.168.0.0/16 as a trusted proxy. That should cover it.

I’m running HA with network: host in docker so there shouldn’t be any port mapping stuff there in the way either, it’s listening directly on my servers NIC.

[okand]

For completeness sake, this is my caddy reverse proxy config. If I’ve understood their documentation correctly x-forwarded-for is enabled by default when you use its reverse proxy.

https://ha.domain.tld {
    tls {
        dns gandi {env.GANDI_API_TOKEN}
    }
    reverse_proxy 192.168.11.31:8123 {
        trusted_proxies private_ranges
    }
}

[okand]

Disregard my previous posts. Setting trusted_proxies: 192.168.11.31 actually worked. I just got confused due to the examples for the http component all also listing subnets. The text says "List of trusted proxies, consisting of IP addresses or networks, that are allowed to set the X-Forwarded-For header. " so you would really think that listing a range that also fits 192.168.11.31 in it would be enough then.

[okand]

Reopening because I'm curious if this is unintended behaviour after all or not actually.

[malokaff]

Hello,
I'm very interested by this case also, I'm not able to make HA working through external RP (Synology), I got ERR_CONNECTION_REFUSED but I cannot see any log on HA...
Also, RP seems to work well with another HTTP app so I'm confident that the feature is working well on synology
I'm interested in any idea to try to debug
I set the log level to debug for HTTP but cannot see any

[issue-triage-workflows]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue has now been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.