Core: proxy access: Unable to connect to Home Assistant

[jardous]

Home Assistant release with the issue:
94.x, latest 95 betas

Last working Home Assistant release (if known):

Operating environment (Hass.io/Docker/Windows/etc.):
HASS running in Python virtual environment with hass --open-gui

Component/platform:

Description of problem:
I am connecting through a server to my home network

client -> public server -> home server

• client is in the Internet
• public server is runnning a TCP4 to TCP6 tunnel (using socat)
• home server is behind a router with all ports opened, all running on IPV6

I get the login page, but sending credentials form leads me to "Unable to connect to Home Assistant." page.

Problem-relevant configuration.yaml entries and (fill out even if it seems unimportant):

Traceback (if applicable):

Additional information:
Running this setup for other services as well - never had an issue.

[dannygreg]

I'm also now seeing this. I can auth totally fine locally but it fails with the below error when routed through Nginx.

What's especially odd is that I can see the refresh tokens being created successfully in the dashboard. So it's "working", but not correctly redirecting the front end. I believe I have my proxy IP correctly trusted.

[dannygreg]

Here's my http config:

http:
    base_url: https://foo.bar.com
    use_x_forwarded_for: true
    trusted_proxies: 192.168.1.187

[JakeHertenstein]

Same problem over here. Anything we can do to narrow this down?

[stale[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue now has been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[dannygreg]

This is still broken in 0.100.3

[Ebbe]

I'm seeing the same thing in 0.101.3. If I enable use_x_forwarded_for there doesn't seem to be anything I can do to connect to ha. Not even locally. Not with or without the header or trusted_proxies

[FerventlyFree]

Seeing the same. 0.101.3

[Ebbe]

Well, it seems for me the problem wasn't in HA, but in nginx, and not supporting websockets. If your proxy server doesn't support websocket you will se that behavior.
Add this to server section in nginx:

proxy_set_header Host $host;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "Upgrade";

[dannygreg]

I can confirm that this fixes the behaviour for me. Probably worth updating docs on using nginx as a proxy and closing this out.

[nboukeffa]

If you're running it on Synology and are using the Application Portal reverse proxy, here what you need to configure:

Control Panel > Applications Portal > Edit > Custom Headers

[stale[bot]]

There hasn't been any activity on this issue recently. Due to the high number of incoming GitHub notifications, we have to clean some of the old issues, as many of them have already been resolved with the latest updates.
Please make sure to update to the latest Home Assistant version and check if that solves the issue. Let us know if that works for you by adding a comment 👍
This issue now has been marked as stale and will be closed if no further activity occurs. Thank you for your contributions.

[jardous]

same problem. Trying to use the ssh tunnel like described in https://www.home-assistant.io/blog/2017/11/02/secure-shell-tunnel/
The login page shows up but sending the login infos results in "Unable to connect to Home Assistant.". Verbose output, debug mode shows nothing...

[msberends]

For the apache users:

<VirtualHost *:443>
    SSLEngine on
    SSLProxyEngine On
    ServerName home.mydomain.com

    <Proxy *>
        Allow from localhost
    </Proxy>

    Header add Connection "Upgrade"
    RequestHeader set Connection "Upgrade"

    RewriteEngine on
    RewriteCond %{HTTP:Upgrade} =websocket
    RewriteRule /(.*)     ws://192.168.1.192:8123/$1  [P,L]
    RewriteCond %{HTTP:Upgrade} !=websocket
    RewriteRule /(.*)     http://192.168.1.192:8123/$1 [P,L]
    ProxyPass / http://192.168.1.192:8123/
    ProxyPassReverse / http://192.168.1.192:8123/
    Header add Connection "Upgrade"
    RequestHeader set Connection "Upgrade"
    ProxyRequests Off

</VirtualHost>

where 192.168.1.192:8123 is then of course the IP address of your Home Assistant instance.