{"record":{"id":"10a0e2b19d30cefe","repo":"home-assistant/core","slug":"unknown-remote-ip-can-t-be-used-for-trusted-networ","errorCode":null,"errorMessage":"Unknown remote ip can't be used for trusted network provider.","messagePattern":"Unknown remote ip can't be used for trusted network provider\\.","errorType":"exception","errorClass":"InvalidAuthError","httpStatus":null,"severity":"error","filePath":"homeassistant/auth/providers/trusted_networks.py","lineNumber":216,"sourceCode":"        if not any(\n            ip_addr in trusted_network for trusted_network in self.trusted_networks\n        ):\n            raise InvalidAuthError(\"Not in trusted_networks\")\n\n        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):\n            raise InvalidAuthError(\"Can't allow access from a proxy server\")\n\n        if is_cloud_connection(self.hass):\n            raise InvalidAuthError(\"Can't allow access from Home Assistant Cloud\")\n\n    @callback\n    @override\n    def async_validate_refresh_token(\n        self, refresh_token: RefreshToken, remote_ip: str | None = None\n    ) -> None:\n        \"\"\"Verify a refresh token is still valid.\"\"\"\n        if remote_ip is None:\n            raise InvalidAuthError(\n                \"Unknown remote ip can't be used for trusted network provider.\"\n            )\n        self.async_validate_access(ip_address(remote_ip))\n\n\nclass TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):\n    \"\"\"Handler for the login flow.\"\"\"\n\n    def __init__(\n        self,\n        auth_provider: TrustedNetworksAuthProvider,\n        ip_addr: IPAddress,\n        available_users: dict[str, str | None],\n        allow_bypass_login: bool,\n    ) -> None:\n        \"\"\"Initialize the login flow.\"\"\"\n        super().__init__(auth_provider)\n        self._available_users = available_users","sourceCodeStart":198,"sourceCodeEnd":234,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/providers/trusted_networks.py#L198-L234","documentation":"Raised when a refresh token created by the trusted_networks provider is validated without a remote IP. Because this provider's entire security model is 'the client IP must be in a trusted network', an unknown (None) remote IP cannot be verified and the token is rejected with InvalidAuthError.","triggerScenarios":"async_validate_refresh_token(refresh_token, remote_ip) is called with remote_ip=None (e.g. a websocket/API call where the transport did not supply a peer address, or a caller omits the argument).","commonSituations":"Internal code paths or custom integrations that call the auth API without passing the request's remote address; unusual proxies stripping peer info; direct loopback tooling that has no socket peer.","solutions":["Pass the actual remote IP: async_validate_refresh_token(token, request.remote_ip) at every call site","Ensure the connection goes through a normal HTTP transport so Home Assistant can derive the peer IP","If writing a custom auth consumer, use hass.auth.async_validate_refresh_token with the request context, not a bare call"],"exampleFix":"# before\nawait provider.async_validate_refresh_token(token)\n# after\nawait provider.async_validate_refresh_token(token, request.remote_ip)","handlingStrategy":"validation","validationCode":"if (remote_ip := request.remote_ip) is None:\n    # reject early with a clear message before calling the provider\n    raise ValueError(\"remote IP unavailable\")\nprovider.async_validate_refresh_token(token, remote_ip)","typeGuard":"def has_remote_ip(request) -> bool:\n    return request is not None and request.remote_ip is not None","tryCatchPattern":"try:\n    provider.async_validate_refresh_token(token, remote_ip)\nexcept InvalidAuthError:\n    # treat as unauthenticated; never retry with None again","preventionTips":["Always pass the transport's remote address to token validation","Centralize auth calls in helpers that carry the request context","Fail fast on missing peer info rather than defaulting to None"],"tags":["auth","refresh-token","api-misuse","home-assistant"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T17:31:12.345Z"}