home-assistant / home-assistant/supervisor

Internal http://supervisor/auth doesn't support Bearer tokens (long lived)

Open
#6,313 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Python
Stars
2.2k
Forks
807
Avg merge
1d 6h
Merged PRs (30d)
55

Description

### Describe the issue you are experiencing

I'm trying to write a tool to manage node-red. Node-red has an endpoint (https://server:1880) that I can hit and authenticate with my home assistant username:password. I've tried configuring a long term token to access this endpoint and am getting a 500 error back.

Tracing the auth through it appears that node-red is attempting to pass the authentication along to http://supervisor/auth to handle the authentication. This in turn is calling the /usr/src/supervisor/supervisor/api/auth.py to do the authentication which only supports basic authentication. When passing a Bearer token to authenticate I'm seeing the following on the docker logs for the supervisor:

```
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 510, in _handle_request
resp = await request_handler(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_app.py", line 569, in _handle
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_middlewares.py", line 117, in impl
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 198, in block_bad_requests
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 208, in system_validation
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 276, in token_validation
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 289, in core_proxy
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/utils.py", line 71, in wrap_api
answer = await method(api, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/auth.py", line 88, in auth
if not await self._process_basic(request, addon):
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/auth.py", line 52, in _process_basic
auth = BasicAuth.decode(request.headers[AUTHORIZATION])
File "/usr/local/lib/python3.13/site-packages/aiohttp/helpers.py", line 150, in decode
raise ValueError("Unknown authorization method %s" % auth_type)
ValueError: Unknown authorization method Bearer
```

What is the possibility of adding support for authenticating with Bearer tokens to internal auth endpoints so the same authentication methods that work externally will work internally?

### What type of installation are you running?

Home Assistant OS

### Which operating system are you running on?

Home Assistant Operating System

### Steps to reproduce the issue

1.
2.
3.
...

### Anything in the Supervisor logs that might be useful for us?

```txt
See above
```

### System information

See above

### Supervisor diagnostics

_No response_

### Additional information

_No response_

Contributor guide

Open the contributing guide

Research direction

Start with supervisor/api/auth.py, especially auth and _process_basic, and trace how aiohttp's BasicAuth.decode handles the Authorization header. Reproduce the reported Bearer-token request through the internal http://supervisor/auth endpoint and compare it with the existing basic-authentication path. Done means the internal endpoint supports the same long-lived Bearer-token authentication without raising the reported ValueError.

Written by the indexing model from the issue text.

Assessment

Tech stack
python
Domain
api, authentication, backend
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.