IP banning problem with http integration

[toby-griffiths]

The problem

I believe the there is a problem with the way the http integration up banning works. In particular with how it interacts with companion app users.

There are several conversations around the web of people frequently being logged out from the companion apps (android & iOS).

See home-assistant/iOS#1871

Some suggested fixes are to disable ip banning, which is obviously not ideal.

I’m not sure how the companion app authenticates, however I tried to switch from home wifi to mobile data and refresh the home dashboard on my app, I was instantly logged out. I've just tried it again, and now the app just displays a blank page, with the following warning in the logs…

Login attempt or request with invalid authentication from 192.168.1.193 (192.168.1.193). Requested URL: '/auth/login_flow/[redacted]'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1)

Here are the logs from previous bans that happened, when attempting to connect remotely…

Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.617Z?filter_entity_id=sensor.[REDACTED_NAME]_s_room_humidity&end_time=2022-12-02T18:24:09.828Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.637Z?filter_entity_id=sensor.living_room_humidity&end_time=2022-12-02T18:24:09.841Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.619Z?filter_entity_id=sensor.bathroom_humidity&end_time=2022-12-02T18:24:09.840Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.699Z?filter_entity_id=sensor.co2_intensity&end_time=2022-12-02T18:24:09.809Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Banned IP 127.0.0.1 for too many login attempts

The companion app issue (linked above) doesn't have any recent activity or suggestions, so I thought I'd ask here to see if anyone had any idea how we might be able to address this problem?

What version of Home Assistant Core has the issue?

core-2022.12.8

What was the last working version of Home Assistant Core?

No response

What type of installation are you running?

Home Assistant OS

Integration causing the issue

http

Link to integration documentation on our website

https://www.home-assistant.io/integrations/http/

Diagnostics information

No response

Example YAML snippet

http:
  server_port: 443
  ssl_certificate: /ssl/fullchain.pem
  ssl_key: /ssl/privkey.pem
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.33.0/24
  ip_ban_enabled: true
  login_attempts_threshold: 5

Anything in the logs that might be useful for us?

Login attempt or request with invalid authentication from 192.168.1.193 (192.168.1.193). Requested URL: '/auth/login_flow/[redacted]'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/16.1 Mobile/15E148 Safari/604.1)


--- And previously ---

Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.617Z?filter_entity_id=sensor.[REDACTED_NAME]_s_room_humidity&end_time=2022-12-02T18:24:09.828Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.637Z?filter_entity_id=sensor.living_room_humidity&end_time=2022-12-02T18:24:09.841Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.619Z?filter_entity_id=sensor.bathroom_humidity&end_time=2022-12-02T18:24:09.840Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Login attempt or request with invalid authentication from localhost (127.0.0.1). Requested URL: '/api/history/period/2022-12-02T18:15:37.699Z?filter_entity_id=sensor.co2_intensity&end_time=2022-12-02T18:24:09.809Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (iPhone; CPU iPhone OS 16_1_1 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2022.10.1 (io.robbie.HomeAssistant; build:2022.424; iOS 16.1.1) Mobile/HomeAssistant, like Safari)
Banned IP 127.0.0.1 for too many login attempts

Additional information

No response

[home-assistant]

Hey there @home-assistant/core, mind taking a look at this issue as it has been labeled with an integration (http) you are listed as a code owner for? Thanks!

Code owner commands

Code owners of http can trigger bot actions by commenting:

• @home-assistant close Closes the issue.
• @home-assistant rename Awesome new title Change the title of the issue.
• @home-assistant reopen Reopen the issue.
• @home-assistant unassign http Removes the current integration label and assignees on the issue, add the integration domain after the command.

_{^{(message by CodeOwnersMention)}}

---

http documentation
http source
_{^{(message by IssueLinks)}}

[frenck]

The companion app issue (linked above) doesn't have any recent activity or suggestions, so I thought I'd ask here to see if anyone had any idea how we might be able to address this problem?

This isn't an core issue. Just creating issues on multiple to get attention on an upstream issue, isn't going to help.

Going to close this issue, as this is an iOS issue to solve.

../Frenck

[toby-griffiths]

OK. Apologies. I had just thought it might spark a conversation with a different set of people about tokens that do/don't work across multiple IP addresses, which I thought might be the problem here.