Skip to content

v7.14.0.dev2056

v7.14.0.dev2056: fix: none-mode webhook connects from claude.ai with no login (#1976)
@kingpanther13 kingpanther13 tagged this 19 Jul 22:54 
* fix: none-mode webhook connects from claude.ai with no login

In none (OAuth-off) webhook mode, claude.ai's connector onboarding
intermittently front-loads OAuth discovery and falls through to Home
Assistant core's origin-root /.well-known/oauth-authorization-server
(which we cannot remove or override), which advertises CIMD but omits
token_endpoint_auth_methods_supported: ["none"] and a registration
endpoint -> "Automatic client registration isn't supported... add an
OAuth Client ID".

In none mode, serve our own corrected path-scoped RFC 8414/9728
discovery plus an invisible auto-approve authorization server (PKCE
S256, allowlist-only redirect guard) so discovery resolves against us
and completes with no HA login. The webhook stays 200 with no bearer
required, so URL-only clients are unaffected; the none<->ha_auth switch
needs no restart. Mirrored into the webhook-proxy dev add-on
(2.0.3.dev2 -> 2.0.3.dev3); stable add-on untouched.

Fixes #1969

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9Akiw2qg7qh6QWiZjqBoX

* fix: don't leak the webhook id via the fixed-path protected-resource in none mode

Address Patch76's review on #1976:
- In none mode the webhook id is the sole credential, but the fixed-path
  {OAUTH_BASE}/protected-resource view (anonymous, guessable) carried it in
  its `resource` field. Serve that view only for the bearer-gated ha_auth /
  legacy modes; the path-scoped well-known view still serves in none mode
  (its id is a route parameter the caller must already know). Mirrored to
  the dev add-on.
- Add Cache-Control: no-store to the dev add-on's auto-approve token
  response for parity with the component.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9Akiw2qg7qh6QWiZjqBoX

* refactor: move _TOKEN_RESPONSE_HEADERS to addon oauth_autoapprove

The add-on's legacy token views don't set no-store, so the constant was
unused in oauth.py and flagged by CodeQL Code Quality (py/unused-global-
variable, which counts only module-local usage). Move it into
oauth_autoapprove.py — its sole consumer.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01H9Akiw2qg7qh6QWiZjqBoX

---------

Co-authored-by: kingpanther13 <kingpanther13@users.noreply.github.com>
Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>
Assets 2
Loading