Trouble with tokens - reverse proxy

[D34DC3N73R]

I have a bit of a strange issue that I've noticed with auth, reverse proxy, and tokens.

I have my HA notification using the following URLs for both preview and image links, just like the documentation.
https://double-take.mydomain.com/api/storage/matches/{{trigger.to_state.attributes.match.filename}}?box=true&token={{trigger.to_state.attributes.token}}

The preview image will show up in the notification, but clicking the link leads to an error page displaying {"error":"Unauthorized"}

Loading the UI, finding the same image, and comparing the links show the last part of the token is different.

For instance, the URL for the image I get from the notification would have something like:
...token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb3V0ZSI6InN0b3JhZ2UiLCJpYXQiOjE2Mjk4MzE0MTgsImV4cCI6MTYyOTgzNTAxOH0.huZHokRVXgSyfYGdYULEDtntf-Hvt1BHgg7JUdZDw64
and the URL for the image I get from the double-take UI would have something like:
...token=eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb3V0ZSI6InN0b3JhZ2UiLCJpYXQiOjE2Mjk4NDk0ODcsImV4cCI6MTYyOTg1MzA4N30.77ji-R4ILNos6ooQ7EpWqheliN-5hI9MnuNKKLdwPDc

It seems weird that the image will show fine in the notification preview, but not actually load when tapping on the image link.

[jakowenko]

Hm...that's strange the preview shows but clicking the link doesn't work. You're sure the links are the same and there's not a small difference that would lead one to not work?

The tokens being different is ok, the UI has separate ones generated to load the images.

Could you post the YAML for your HA notification? Feel free to omit anything that is sensitive. I just want to make sure nothing is missing.

[D34DC3N73R]

Sure, here's the automation.

- alias: Notification - Double-Take
  mode: single
  trigger:
  - platform: state
    entity_id: sensor.double_take_person1
  - platform: state
    entity_id: sensor.double_take_person2
  condition:
  - condition: template
    value_template: '{{ trigger.to_state.state != trigger.from_state.state }}'
  action:
  - service: notify.mobile_app_pixel
    data:
      message: '{{trigger.to_state.attributes.friendly_name}} ({{trigger.to_state.attributes.match.confidence}}%)
        is near the {{trigger.to_state.state}}<br> {{trigger.to_state.attributes.match.detector}}'
      data:
        image: https://doubletake.mydomain.com/api/storage/matches/{{trigger.to_state.attributes.match.filename}}?box=true&token={{trigger.to_state.attributes.token}}
        actions:
        - action: URI
          title: View Image
          uri: https://doubletake.mydomain.com/api/storage/matches/{{trigger.to_state.attributes.match.filename}}?box=true&token={{trigger.to_state.attributes.token}}

[jakowenko]

Ya those match up, so should be good. Just thought of something as well, the token for these notifications is currently only good for 1 hour. Is the notification you are clicking on older than 1 hour? If so, that would explain it and I could increase the time or make it adjustable.

[D34DC3N73R]

That could definitely be the issue. Making it adjustable seems ideal. Personally, I would have mine configured for around 12 hours.

[jakowenko]

Hey @D34DC3N73R, I pushed a new beta build with the ability to adjust this. I'm defaulting it to 24h currently, but can be adjusted by adding this to your config. The value is expressed in seconds or a string describing a time span zeit/ms. Let me know if this resolves your issue.

token:
  image: 24h

[D34DC3N73R]

Thanks, that did the trick!