search

diyhue / hassio-addon

35 stars 11 forks source link

Authentication and security issue #15

Open 0R2YPsALXTVed6y opened 1 year ago

0R2YPsALXTVed6y commented 1 year ago

Hi there, Can you please help me/us find a way to fix authentication for diyhue. Since we have to use port 80, diyhue is very exposed. Anyone who opens the hass url locally as well as publicly (all over the world!) has access to diyhue. The next security issue is that the long-lived hass token is plain displayed. So everyone can access hass if they want. User and password change are not a problem with the debugging workaround, but with the forced auto-login it makes no sense. Hopefully there is a solution because of all the options for emulated hue, diyhue is the only real working way to do it ATM!

mariusmotea commented 1 year ago

Need some help here, maybe somebody with better skills in flask can provide some advice.

0R2YPsALXTVed6y commented 1 year ago

Hi! Thanks for you quick reply. If you search for: #@flask_login.login_required in de main source, you can see login is comment out a few times. I don't know for sure, but maybe it's the solution. Hopefully someone with skills of flask can confirm this.