Merge branch 'blakeblackshear:dev' into 0.16-fixed-Jan-synced

docs/docs/guides/configuring_go2rtc.md

@@ -7,7 +7,7 @@ title: Configuring go2rtc
 
 Use of the bundled go2rtc is optional. You can still configure FFmpeg to connect directly to your cameras. However, adding go2rtc to your configuration is required for the following features:
 
-- WebRTC or MSE for live viewing with higher resolutions and frame rates than the jsmpeg stream which is limited to the detect stream
+- WebRTC or MSE for live viewing with audio, higher resolutions and frame rates than the jsmpeg stream which is limited to the detect stream and does not support audio
 - Live stream support for cameras in Home Assistant Integration
 - RTSP relay for use with other consumers to reduce the number of connections to your camera streams
 

docs/docs/troubleshooting/faqs.md

@@ -17,6 +17,10 @@ ffmpeg:
     record: preset-record-generic-audio-aac
 ```
 
+### How can I get sound in live view?
+
+Audio is only supported for live view when go2rtc is configured, see [the live docs](../configuration/live.md) for more information.
+
 ### I can't view recordings in the Web UI.
 
 Ensure your cameras send h264 encoded video, or [transcode them](/configuration/restream.md).

frigate/api/fastapi_app.py

@@ -35,14 +35,13 @@ from frigate.storage import StorageMaintainer
 logger = logging.getLogger(__name__)
 
 
-def check_csrf(request: Request):
+def check_csrf(request: Request) -> bool:
     if request.method in ["GET", "HEAD", "OPTIONS", "TRACE"]:
-        pass
+        return True
     if "origin" in request.headers and "x-csrf-token" not in request.headers:
-        return JSONResponse(
-            content={"success": False, "message": "Missing CSRF header"},
-            status_code=401,
-        )
+        return False
+
+    return True
 
 
 # Used to retrieve the remote-user header: https://starlette-context.readthedocs.io/en/latest/plugins.html#easy-mode
@@ -80,7 +79,12 @@ def create_fastapi_app(
     @app.middleware("http")
     async def frigate_middleware(request: Request, call_next):
         # Before request
-        check_csrf(request)
+        if not check_csrf(request):
+            return JSONResponse(
+                content={"success": False, "message": "Missing CSRF header"},
+                status_code=401,
+            )
+
         if database.is_closed():
             database.connect()