home-assistant / home-assistant/supervisor
Internal http://supervisor/auth doesn't support Bearer tokens (long lived)
- Dominant language
- Python
- Stars
- 2.2k
- Forks
- 807
- Avg merge
- 1d 6h
- Merged PRs (30d)
- 55
Description
### Describe the issue you are experiencing
I'm trying to write a tool to manage node-red. Node-red has an endpoint (https://server:1880) that I can hit and authenticate with my home assistant username:password. I've tried configuring a long term token to access this endpoint and am getting a 500 error back.
Tracing the auth through it appears that node-red is attempting to pass the authentication along to http://supervisor/auth to handle the authentication. This in turn is calling the /usr/src/supervisor/supervisor/api/auth.py to do the authentication which only supports basic authentication. When passing a Bearer token to authenticate I'm seeing the following on the docker logs for the supervisor:
```
Traceback (most recent call last):
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_protocol.py", line 510, in _handle_request
resp = await request_handler(request)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_app.py", line 569, in _handle
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/local/lib/python3.13/site-packages/aiohttp/web_middlewares.py", line 117, in impl
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 198, in block_bad_requests
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 208, in system_validation
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 276, in token_validation
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/middleware/security.py", line 289, in core_proxy
return await handler(request)
^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/utils.py", line 71, in wrap_api
answer = await method(api, *args, **kwargs)
^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/auth.py", line 88, in auth
if not await self._process_basic(request, addon):
~~~~~~~~~~~~~~~~~~~^^^^^^^^^^^^^^^^
File "/usr/src/supervisor/supervisor/api/auth.py", line 52, in _process_basic
auth = BasicAuth.decode(request.headers[AUTHORIZATION])
File "/usr/local/lib/python3.13/site-packages/aiohttp/helpers.py", line 150, in decode
raise ValueError("Unknown authorization method %s" % auth_type)
ValueError: Unknown authorization method Bearer
```
What is the possibility of adding support for authenticating with Bearer tokens to internal auth endpoints so the same authentication methods that work externally will work internally?
### What type of installation are you running?
Home Assistant OS
### Which operating system are you running on?
Home Assistant Operating System
### Steps to reproduce the issue
1.
2.
3.
...
### Anything in the Supervisor logs that might be useful for us?
```txt
See above
```
### System information
See above
### Supervisor diagnostics
_No response_
### Additional information
_No response_
Contributor guide
Research direction
Start with supervisor/api/auth.py, especially auth and _process_basic, and trace how aiohttp's BasicAuth.decode handles the Authorization header. Reproduce the reported Bearer-token request through the internal http://supervisor/auth endpoint and compare it with the existing basic-authentication path. Done means the internal endpoint supports the same long-lived Bearer-token authentication without raising the reported ValueError.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- python
- Domain
- api, authentication, backend
- Issue type
- Feature
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100