{"record":{"id":"47c2e98be9487e7b","repo":"home-assistant/core","slug":"can-t-allow-access-from-a-proxy-server","errorCode":null,"errorMessage":"Can't allow access from a proxy server","messagePattern":"Can't allow access from a proxy server","errorType":"exception","errorClass":"InvalidAuthError","httpStatus":null,"severity":"warning","filePath":"homeassistant/auth/providers/trusted_networks.py","lineNumber":204,"sourceCode":"        raise NotImplementedError\n\n    @callback\n    def async_validate_access(self, ip_addr: IPAddress) -> None:\n        \"\"\"Make sure the access from trusted networks.\n\n        Raise InvalidAuthError if not.\n        Raise InvalidAuthError if trusted_networks is not configured.\n        \"\"\"\n        if not self.trusted_networks:\n            raise InvalidAuthError(\"trusted_networks is not configured\")\n\n        if not any(\n            ip_addr in trusted_network for trusted_network in self.trusted_networks\n        ):\n            raise InvalidAuthError(\"Not in trusted_networks\")\n\n        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):\n            raise InvalidAuthError(\"Can't allow access from a proxy server\")\n\n        if is_cloud_connection(self.hass):\n            raise InvalidAuthError(\"Can't allow access from Home Assistant Cloud\")\n\n    @callback\n    @override\n    def async_validate_refresh_token(\n        self, refresh_token: RefreshToken, remote_ip: str | None = None\n    ) -> None:\n        \"\"\"Verify a refresh token is still valid.\"\"\"\n        if remote_ip is None:\n            raise InvalidAuthError(\n                \"Unknown remote ip can't be used for trusted network provider.\"\n            )\n        self.async_validate_access(ip_address(remote_ip))\n\n\nclass TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):","sourceCodeStart":186,"sourceCodeEnd":222,"githubUrl":"https://github.com/home-assistant/core/blob/58a3fdb3ea0538617f0a07efcfba6294de64fd59/homeassistant/auth/providers/trusted_networks.py#L186-L222","documentation":"Raised by the trusted_networks auth provider when the client IP matches one of the configured trusted proxy networks. Automatic login from proxies is deliberately blocked because a proxy forwards other clients' requests, so trusting it would effectively trust every upstream client.","triggerScenarios":"async_validate_access(ip_addr) is called with an address that is inside a network listed in the provider's trusted_proxies option (configured to keep proxies themselves from being trusted for passwordless auth).","commonSituations":"A reverse proxy (nginx, Traefik) is listed in both trusted_proxies of the auth provider and its host IP also matches a trusted_networks entry; or the client really is the proxy because use_x_forwarded_for is not enabled on the http: integration.","solutions":["Enable use_x_forwarded_for: true and set trusted_proxies on the http: integration so the real client IP is forwarded and validated instead of the proxy IP","Remove the proxy's IP/subnet from trusted_networks — proxies should never be trusted directly","Log in with credentials for this client"],"exampleFix":"# configuration.yaml\nhttp:\n  use_x_forwarded_for: true\n  trusted_proxies:\n    - 172.30.0.0/16  # after: proxy IP no longer seen as the client","handlingStrategy":"validation","validationCode":"import ipaddress\n\nclient = ipaddress.ip_address(request.remote_ip)\nproxy_nets = [ipaddress.ip_network(n) for n in provider.trusted_proxies]\nif any(client in p for p in proxy_nets):\n    # do not attempt trusted-networks login for this client","typeGuard":"def is_from_proxy(ip: str, proxies: list[str]) -> bool:\n    addr = ipaddress.ip_address(ip)\n    return any(addr in ipaddress.ip_network(p) for p in proxies)","tryCatchPattern":"try:\n    provider.async_validate_access(ip_addr)\nexcept InvalidAuthError as err:\n    if \"proxy\" in str(err):\n        # fix X-Forwarded-For handling instead of retrying","preventionTips":["Always set use_x_forwarded_for + trusted_proxies on http: when behind a proxy","Never put the proxy's own subnet into trusted_networks","Document which IPs are proxies vs clients in network config"],"tags":["auth","trusted-networks","reverse-proxy","home-assistant"],"backgroundTag":null,"analyzedSha":"58a3fdb3ea0538617f0a07efcfba6294de64fd59","analyzedAt":"2026-08-14T20:54:38.818Z","schemaVersion":2},"datasetVersion":"2026-08-15T22:17:37.221Z"}