core: Broken API authorization with long-lived access token with hassio API

The problem

  • I get “(401) Unauthorized” REST API error message after upgrading my Home Assistant Core 2023.3.1 to 2023.3.3
  • I’m using the same long-lived access token, and the issue is gone once I fallback to version 2023.3.1. When I upgrade to 2023.3.3 - the issue returns. I tried to create new long-lived access token but it still fails.
  • I’m using Home Assistant OS (running on Home Assistant Blue hardware). Trying to access API both locally and via Nabu Casa
  • Tried using HTTP POST and GET methods
  • Other people seem to experience a similar kind of issue, and one of the users attached the logs with an authorization issue, but the logs do not explain why access tokens stopped working suddenly

Here goes one of the scenarios that I use for the issue reproduction:

  • Open Postman application for REST API testing (I use it for the automated regression testing of the Fibaro Home Center 3 and Home Assistant integration, but not able to share the collection itself due to security reasons)
  • Make REST API call using URL https://<nabucasa-anonymized>/api/hassio/ingress/session, and pass Authorization Bearer token within the HTTP request header

Expected result:

  • HTTP response code 200
  • HTTP response body { "result": "ok", "data": { "session": "<...>" } }

Actual result:

  • HTTP response code 401 (Unauthorised)

What version of Home Assistant Core has the issue?

core-2023.3.3

What was the last working version of Home Assistant Core?

core-2023.3.1

What type of installation are you running?

Home Assistant OS

Integration causing the issue

api

Link to integration documentation on our website

https://www.home-assistant.io/integrations/api

Diagnostics information

No response

Example YAML snippet

No response

Anything in the logs that might be useful for us?

No response

Additional information

No response

About this issue

  • Original URL
  • State: closed
  • Created a year ago
  • Comments: 20 (6 by maintainers)

Most upvoted comments

I have had the same issue since 17-03-23. Local Host is working but my Nabu Casa REST API is not. home-assistant_2023-03-19T11-11-47.551Z.log

Current version Home Assistant 2023.3.5 Supervisor 2023.03.1 Operating System 9.5 Frontend 20230309.1 - latest

From the logs you will see there have been failed authorization requests. Some belong to me but not the Mac OSx requests. I tested the API with known good and known bad authorization tokens for both the local and NabuCasa Cloud URL to see if it was my token.

The issue is not on my local instance. The token is valid and the previous three months have been without issue.

I have the same situation after upgrade HA core.