Recurrent Login attempt or request with invalid authentication

[maniackcrudelis]

The problem

Since the upgrade from 2023.2.3 to 2023.3.4, I have recurrent errors saying Login attempt or request with invalid authentication when using the API.

The errors, so far, happened with the custom card mini graph card and with the automations themselves, as soon as I go to config/automation/dashboard.

Each time, an error appears saying

Login attempt or request with invalid authentication from 192.168.1.48 (192.168.1.48). See the log for details.

The IP is from my main computer visiting the web interface.

I managed to solve temporarily the issue by cleaning up completely the Local storage of my Firefox. But the issue reappears soon afterwards.

The error is fatal, with the custom card mini graph card, I don't have any graph showing, and with the automation, en error message says This automation can not be edited from the UI, because it is not stored in the automations.yaml file, or doesn't have an ID.
If I try to migrate, as suggested, I have en error Response error: 401 and the same log about the login attempt.

The issue does not happen with Chromium (so far...) and didn't happened with the version 2023.2.3.

What version of Home Assistant Core has the issue?

2023.3.4

What was the last working version of Home Assistant Core?

2023.2.3

What type of installation are you running?

Home Assistant Core

Integration causing the issue

No response

Link to integration documentation on our website

No response

Diagnostics information

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.1.48 (192.168.1.48). Requested URL: '/api/history/period/2023-03-22T13:13:12.526Z?filter_entity_id=sensor.global_temperature&end_time=2023-03-22T16:20:16.450Z&skip_initial_state&minimal_response'. (Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0)

WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.1.48 (192.168.1.48). Requested URL: '/api/config/automation/config/1676544820763'. (Mozilla/5.0 (X11; Linux x86_64; rv:102.0) Gecko/20100101 Firefox/102.0)

Additional information

No response

[maniackcrudelis]

Update on that issue, still relevant.

I've tried to purge all Refresh Tokens I had, without any success.
Also tried to add trusted_networks: - 192.168.1.48 and trusted_proxies: - 192.168.1.48 but nothing solved the issue.
No problem have arisen from Chromium, the issue only exist with Firefox.

I have no idea what really cause the issue, since it was perfectly working until the upgrade.

[maniackcrudelis]

After an upgrade to 2023.3.6, the issue is still there.

I've seen a lot of reports on the forum about the same issue, would be really appreciated if someone can have a look at it.

[vicfalls]

I do have the same issue:

Home Assistant 2023.4.2
Supervisor 2023.04.0
Operating System 9.5
Frontend 20230406.1 - latest

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:80
Integration: HTTP ([documentation](https://www.home-assistant.io/integrations/http), [issues](https://github.com/home-assistant/home-assistant/issues?q=is%3Aissue+is%3Aopen+label%3A%22integration%3A+http%22))
First occurred: 11:31:20 (135 occurrences)
Last logged: 12:08:16

Login attempt or request with invalid authentication from x.x.x.x (x.x.x.x). Requested URL: '/auth/token'. (Home Assistant/2023.2.1 (io.robbie.HomeAssistant; build:2023.452; macOS(Catalyst) 13.2.1) Alamofire/5.6.2)
Login attempt or request with invalid authentication from 192.168.1.197 (192.168.1.197). Requested URL: '/api/websocket'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2023.2.1 (io.robbie.HomeAssistant; build:2023.452; macOS 13.2.1) Mobile/HomeAssistant, like Safari)

Does anyone knows what I can do?

Thanks Vic

[blackwood821]

I'm experiencing the same issue when attempting to link the home assistant alexa skill from the alexa app. I can log in using my public home assistant URL in the browser with the exact same credentials without issue.

[tomg1970]

I do have the same issue:

Home Assistant 2023.4.2

Supervisor 2023.04.0

Operating System 9.5

Frontend 20230406.1 - latest

Logger: homeassistant.components.http.ban

Source: components/http/ban.py:80

Integration: HTTP ([documentation](https://www.home-assistant.io/integrations/http), [issues](https://github.com/home-assistant/home-assistant/issues?q=is%3Aissue+is%3Aopen+label%3A%22integration%3A+http%22))

First occurred: 11:31:20 (135 occurrences)

Last logged: 12:08:16

Login attempt or request with invalid authentication from x.x.x.x (x.x.x.x). Requested URL: '/auth/token'. (Home Assistant/2023.2.1 (io.robbie.HomeAssistant; build:2023.452; macOS(Catalyst) 13.2.1) Alamofire/5.6.2)

Login attempt or request with invalid authentication from 192.168.1.197 (192.168.1.197). Requested URL: '/api/websocket'. (Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Home Assistant/2023.2.1 (io.robbie.HomeAssistant; build:2023.452; macOS 13.2.1) Mobile/HomeAssistant, like Safari)

Does anyone knows what I can do?

Thanks Vic

same error

[Ufinexa]

Had the same issue after attempting to call for my lights using my stream deck today, I am assuming a new update has broken something?

[fabulouss56]

Hi, I have the same issue 20230503.3 : 2023.5.4

i don't have any file named : ip_bans in my config folder.

Logger: homeassistant.components.http.ban
Source: components/http/ban.py:80
Integration: HTTP (documentation, issues)
First occurred: 01:34:33 (12 occurrences)
Last logged: 01:54:32

Login attempt or request with invalid authentication from 192.168.1.254 (192.168.1.254). Requested URL: '/auth/token'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36)
Login attempt or request with invalid authentication from 192.168.1.254 (192.168.1.254). Requested URL: '/auth/login_flow/a3e1420b9bec3970a4dd1aa58f35ab16'. (Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/114.0.0.0 Safari/537.36)

Some news on it ?

[maniackcrudelis]

Currently on 2023.5.4, the error is still there.
It doesn't seems to have been any fix on this issue...

[MikOsle]

I have the same error. I cannot access from LAN, only from WAN. And not ip_ban:yaml file is generated. It seems like all local IPs are banned.

[kaylamillerdev]

Currently have this issue on 2023.7.1 :(

[Haeusele]

I have the same problem while trying to authorize the alexa skill. Login in the browser works well.
2023-07-09 21:49:35.304 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from dynamic-xxx-114-093-083.46.114.pool.telefonica.de (46.114.93.xx). Requested URL: '/auth/login_flow/7a7251da7304e66f2b3eed5033afb2xx'. (Mozilla/5.0 (Android 13; Mobile; rv:109.0) Gecko/115.0 Firefox/115.0)

[yersoncontacto]

Same error here :( [homeassistant.components.http.ban] Login attempt or request with invalid authentication from customer.sntochl1.pop.starlinkisp.net Requested URL: '/auth/token'. (Home Assistant/2023.4 (io.robbie.HomeAssistant; build:2023.460; iOS 16.5.1) Alamofire/5.6.4)

[edwin19861218]

same error in 20230705.1:
2023-07-11 22:02:55.744 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from edwinsmacmini (10.0.0.5). Requested URL: '/auth/login_flow/966547c93ddf3d00bd6e7306ab5d8a9b'. (Mozilla/5.0 (iPhone; CPU iPhone OS 17_0 like Mac OS X) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.0 Mobile/15E148 Safari/604.1)

[blackwood821]

In case this helps anyone else, my issue was that I was using a password manager (LastPass) when linking the skill in the Alexa app and even though it filled in the username and password on the home assistant login form, it must not have been triggering a changed event because it was not submitting any credentials. As soon as I focused on the password field, added a space and deleted a space and resubmitted the form, it worked.

[andyli1985]

In case this helps anyone else, my issue was that I was using a password manager (LastPass) when linking the skill in the Alexa app and even though it filled in the username and password on the home assistant login form, it must not have been triggering a changed event because it was not submitting any credentials. As soon as I focused on the password field, added a space and deleted a space and resubmitted the form, it worked.

Thank you so much! Following your instruction solved my problem. In my case, I was using Bitwarden to fill in the password.

[HakamSaffour]

this solved my problem
https://community.home-assistant.io/t/login-attempt-or-request-with-invalid-authentication-when-trying-to-access-remotely/373848/2

[mwhrtin]

In case this helps anyone else, my issue was that I was using a password manager (LastPass) when linking the skill in the Alexa app and even though it filled in the username and password on the home assistant login form, it must not have been triggering a changed event because it was not submitting any credentials. As soon as I focused on the password field, added a space and deleted a space and resubmitted the form, it worked.

I just want to mention that this solved my issues as well. I've had this issue from time to time across different Home Assistant versions, when logging in on different machines using different browsers, and I've never been able to figure out why some were getting IP blocked shortly after login and why others didn't . After reading this I realized that I was using either Safari autofill or Strongbox autofill when entering the credentials every time my IP was blocked.

I copy-pasted the credentials to the Home Assistant login form instead of using the Safari autofill on one of the machines that were continuously IP blocked directly after login, and when doing this manually instead of with autofill the login was successful and the authentication persisted without getting IP blocked..

[apedance]

Having the same issue with latest updates as of today.
Using home assistant cloud as connection. Unable to login.
Using nginx provided url. Unable to login.

[projektdotnet]

Was also using a password manager (bitwarden) to auto-fill, manually filling fields also resolved for me on mobile FF which is the only place it was having issues. Thank you @blackwood821!

[AlexeyVT]

Had the same problem. In the browser console log I found that there was no connection to the web socket. I adjusted the availability of wss, the problem was solved. Maybe it will help someone

[malballuk1]

Just started getting this issue
Login attempt or request with invalid authentication from 192.168.1.243 (192.168.1.243). See the log for details.

This notification comes up when I play a track from my mobile to the Sonos play 1 not touching HA

I do have the Sonos integration but not playing from there

[LLin233]

Had the same problem. In the browser console log I found that there was no connection to the web socket. I adjusted the availability of wss, the problem was solved. Maybe it will help someone

could you add some details about how you adjust the availability of wss? Thanks!

[sven-debug]

Same issue here. Any news on a solution progress?

[miamilabs]

I moved my docker container from 1 to another machine and then this started to happen..
The original machine still works... Any one managed to fix this?

[troffasky]

Not sure what caused this for me. UI stopped responding so I refreshed the tab. It accepts a login and then just goes round in a loop. Restarted container, deleted all cookies, no difference. For me, updating to 2024.5.1 was the fix.

[empewoow]

Got the same issue, with Bitwarden autofill it did not work, while copying and pasting the username and password works...

[troffasky]

For me, updating to 2024.5.1 was the fix.

I am pretty sure now that the update itself wasn't the fix, it was the update process that did something to un-block my IP.

[leonbrag]

I have the same issue. I am running HASS in Docker container. I also have Frigate integration enabled.
homeassistant | 2024-08-19 21:59:04.567 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 192.168.4.158 (192.168.4.158). Requested URL: '/auth/token'. (HomeAssistant-Extensions-PushProvider/2024.7 (io.robbie.HomeAssistant.PushProvider; build:2024.730; iOS 17.5.1) Alamofire/5.8.0)``

[jeeftor]

I'm stuck in a loop with this issue

The only "progress" I've made is updating my configuration.yaml with a different port:

http:
  server_port: 8124

Its not really a fix - but something is messed with tokens

[jaddie]

I am also experiencing this problem on the latest version, in the process of testing switching to a firefox based browser, this is rather disappointing that an issue of this level of importance has existed this long without any apparent fix or am I missing something?

[jeeftor]

Do you have the Alexa media player integration. I think there is a bug with it

[troffasky]

an issue of this level of importance

It's not "an issue", I don't think. There are multiple causes for this error, the "real bug" is probably that the various causes don't log their own specific messages.

[Z0472]

Has this issue been resolved?
I access HA through IIS reverse proxy. Everything worked fine for a few days. Now without any intervention I will not connect to HA via reverse proxy, only via IP:port.
There is an error in the log:
2024-11-06 17:54:55.210 WARNING (MainThread) [homeassistant.components.http.ban] Login attempt or request with invalid authentication from 78-80-112-69.customers.tmcz.cz (78.80.112.69). Requested URL: '/auth/token'. (Mozilla/5.0 (Linux; Android 10; K) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/130.0.0.0 Mobile Safari/537.36)

It doesn't work from any browser, no passwords are saved, I have to write them in the HA login form.

[troffasky]

@Z0472 your login coming from a public IP so the "obvious" thing to check is, does the user have "Local access only" ticked?

[matr1xreloaded]

I have similar issue . HA app and web login works fine on my MacBook,ipad, other iPhone and Samsung tablet

[Z0472]

@Z0472 your login coming from a public IP so the "obvious" thing to check is, does the user have "Local access only" ticked?

Thanks for the tip. Where is this setting?

[altShiftDev]

Has anyone figured this out? I'm experiencing this with Cloudflare tunnel on the latest version of HA (2024.12), both cloudflare and HA are running in docker.

[sand-digger]

反代设置中目标协议要选“http和websocket”
请求头要添加
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection 'upgrade';

[rcdailey]

One thing I didn't see mentioned in this issue is the HTTP response you get back when it fails to log you in...

{"message":"IP address changed"}

I don't know why it would be responding to this. I tried typing in username and password manually (without autofill from a PW manager) and it still endlessly fails and refuses to log you in.

Very frustrating issue.

[Z0472]

Hi all,
If you have reversed proxy,
set in configuration.yaml this:
use_x_forwarded_for: true
trusted_proxies:
- 192.168.1.0/24
- 172.20.0.0/24
-

[icna99a]

Same issue here. It started several month ago on my main computer in the same LAN.
It happens when I access HA from it's local IP directly or when I access it via the host file and the reverse proxy on my NAS.
It happens instantly when entering HA with Firefox or Edge, I can log in but I have the error.

Enregistreur: homeassistant.components.http.ban
Source: components/http/ban.py:136
intégration: HTTP (documentation, problèmes)
S'est produit pour la première fois: 00:34:20 (9863 occurrences)
Dernier enregistrement: 14:58:42
Login attempt or request with invalid authentication from 192.168.x.x (192.168.x.x). Requested URL: '/api/websocket'. (Mozilla/5.0 (Windows NT 6.2; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) QtWebEngine/6.7.1 Chrome/118.0.5993.220 Safari/537.36)

Everything was working fine until it wasn't.
The reverse proxy on the Synology NAS has the correct headers mentioned above :

Upgrade -> $http_upgrade
Connection -> $connection_upgrade

My configuration yaml has the correct configuration :

homeassistant:
external_url: "https://alias.domain.tld"
internal_url: "http://192.168.x.x:8123"

http:
cors_allowed_origins:
- https://alias.domain.tld
use_x_forwarded_for: true
trusted_proxies:

• 192.168.x.x # the local IP of my NAS doing reverse proxy, was working only with this line previously
• 192.168.x.x/24 # added this line to test if it was because the IP from my computer was sent to HA

ip_ban_enabled: false # to be sure during testing

Tried everything I read without luck so far.