core: Broken API authorization with long-lived access token with hassio API
The problem
- I get “(401) Unauthorized” REST API error message after upgrading my Home Assistant Core 2023.3.1 to 2023.3.3
- I’m using the same long-lived access token, and the issue is gone once I fallback to version 2023.3.1. When I upgrade to 2023.3.3 - the issue returns. I tried to create new long-lived access token but it still fails.
- I’m using Home Assistant OS (running on Home Assistant Blue hardware). Trying to access API both locally and via Nabu Casa
- Tried using HTTP POST and GET methods
- Other people seem to experience a similar kind of issue, and one of the users attached the logs with an authorization issue, but the logs do not explain why access tokens stopped working suddenly
Here goes one of the scenarios that I use for the issue reproduction:
- Open Postman application for REST API testing (I use it for the automated regression testing of the Fibaro Home Center 3 and Home Assistant integration, but not able to share the collection itself due to security reasons)
- Make REST API call using URL
https://<nabucasa-anonymized>/api/hassio/ingress/session, and pass Authorization Bearer token within the HTTP request header
Expected result:
- HTTP response code
200 - HTTP response body
{ "result": "ok", "data": { "session": "<...>" } }
Actual result:
- HTTP response code
401 (Unauthorised)
What version of Home Assistant Core has the issue?
core-2023.3.3
What was the last working version of Home Assistant Core?
core-2023.3.1
What type of installation are you running?
Home Assistant OS
Integration causing the issue
api
Link to integration documentation on our website
https://www.home-assistant.io/integrations/api
Diagnostics information
No response
Example YAML snippet
No response
Anything in the logs that might be useful for us?
No response
Additional information
No response
About this issue
- Original URL
- State: closed
- Created a year ago
- Comments: 20 (6 by maintainers)
I have had the same issue since 17-03-23. Local Host is working but my Nabu Casa REST API is not. home-assistant_2023-03-19T11-11-47.551Z.log
Current version Home Assistant 2023.3.5 Supervisor 2023.03.1 Operating System 9.5 Frontend 20230309.1 - latest
From the logs you will see there have been failed authorization requests. Some belong to me but not the Mac OSx requests. I tested the API with known good and known bad authorization tokens for both the local and NabuCasa Cloud URL to see if it was my token.
The issue is not on my local instance. The token is valid and the previous three months have been without issue.
I have the same situation after upgrade HA core.