Bram KragtenandGitHub fbb76a8ba0 Filter expired camera/image proxy requests in service worker (#52534) ...

Pre-validate the credential on camera_proxy, camera_proxy_stream and
image_proxy URLs before letting them hit core. Requests with a missing
or "undefined" token, or with an authSig JWT whose exp has passed, are
short-circuited to a synthetic 401 and never reach the server.

This silences spurious "Login attempt or request with invalid
authentication" warnings from homeassistant.components.http.ban that
fire when the browser replays a stale <img src> after BFCache restore,
tab resume, or a network change. The signed-path TTL is short (30s by
default) and image elements happily hold onto the URL long after that.

Limitations: service workers only run on secure contexts, so this does
not help users on plain http LAN access. A core-side fix to ban.py
that distinguishes expired-but-validly-signed paths from real login
attempts remains the principled fix and covers all clients.

2026-06-11 16:35:32 +03:00

..

app.ts

Add typography styles (#25171)

2025-04-28 16:04:47 +03:00

authorize.ts

Add typography styles (#25171)

2025-04-28 16:04:47 +03:00

core.ts

…

custom-panel.ts

Replace unload event handler for custom panels with pagehide (#28781)

2026-01-06 09:07:52 +00:00

onboarding.ts

Add typography styles (#25171)

2025-04-28 16:04:47 +03:00

service-worker.ts

Filter expired camera/image proxy requests in service worker (#52534)

2026-06-11 16:35:32 +03:00