home-assistant/core · warning · InvalidAuthError

Can't allow access from a proxy server

Error message

Can't allow access from a proxy server

What it means

Raised by the trusted_networks auth provider when the client IP matches one of the configured trusted proxy networks. Automatic login from proxies is deliberately blocked because a proxy forwards other clients' requests, so trusting it would effectively trust every upstream client.

Source

Thrown at homeassistant/auth/providers/trusted_networks.py:204

        raise NotImplementedError

    @callback
    def async_validate_access(self, ip_addr: IPAddress) -> None:
        """Make sure the access from trusted networks.

        Raise InvalidAuthError if not.
        Raise InvalidAuthError if trusted_networks is not configured.
        """
        if not self.trusted_networks:
            raise InvalidAuthError("trusted_networks is not configured")

        if not any(
            ip_addr in trusted_network for trusted_network in self.trusted_networks
        ):
            raise InvalidAuthError("Not in trusted_networks")

        if any(ip_addr in trusted_proxy for trusted_proxy in self.trusted_proxies):
            raise InvalidAuthError("Can't allow access from a proxy server")

        if is_cloud_connection(self.hass):
            raise InvalidAuthError("Can't allow access from Home Assistant Cloud")

    @callback
    @override
    def async_validate_refresh_token(
        self, refresh_token: RefreshToken, remote_ip: str | None = None
    ) -> None:
        """Verify a refresh token is still valid."""
        if remote_ip is None:
            raise InvalidAuthError(
                "Unknown remote ip can't be used for trusted network provider."
            )
        self.async_validate_access(ip_address(remote_ip))


class TrustedNetworksLoginFlow(LoginFlow[TrustedNetworksAuthProvider]):

View on GitHub (pinned to 58a3fdb3ea)

Solutions

  1. Enable use_x_forwarded_for: true and set trusted_proxies on the http: integration so the real client IP is forwarded and validated instead of the proxy IP
  2. Remove the proxy's IP/subnet from trusted_networks — proxies should never be trusted directly
  3. Log in with credentials for this client

Example fix

# configuration.yaml
http:
  use_x_forwarded_for: true
  trusted_proxies:
    - 172.30.0.0/16  # after: proxy IP no longer seen as the client
Defensive patterns

Strategy: validation

Validate before calling

import ipaddress

client = ipaddress.ip_address(request.remote_ip)
proxy_nets = [ipaddress.ip_network(n) for n in provider.trusted_proxies]
if any(client in p for p in proxy_nets):
    # do not attempt trusted-networks login for this client

Type guard

def is_from_proxy(ip: str, proxies: list[str]) -> bool:
    addr = ipaddress.ip_address(ip)
    return any(addr in ipaddress.ip_network(p) for p in proxies)

Try / catch

try:
    provider.async_validate_access(ip_addr)
except InvalidAuthError as err:
    if "proxy" in str(err):
        # fix X-Forwarded-For handling instead of retrying

Prevention

When it happens

Trigger: async_validate_access(ip_addr) is called with an address that is inside a network listed in the provider's trusted_proxies option (configured to keep proxies themselves from being trusted for passwordless auth).

Common situations: A reverse proxy (nginx, Traefik) is listed in both trusted_proxies of the auth provider and its host IP also matches a trusted_networks entry; or the client really is the proxy because use_x_forwarded_for is not enabled on the http: integration.

Related errors

AI-assisted analysis of home-assistant/core@58a3fdb3ea (2026-08-14). Data as JSON: /api/errors/47c2e98be9487e7b. Report an issue: GitHub.