* reject cross-origin websocket handshakes
Neither /ws nor the jsmpeg websockets checked Origin, and the internal port grants admin to everyone, so any page a LAN user visited could open ws://frigate:5000/ws and send commands or read streams. Both servers now reject a browser handshake whose Origin host matches neither Host nor X-Forwarded-Host, and allow handshakes without an Origin for non-browser clients. nginx now forwards an outer proxy's X-Forwarded-Host instead of overwriting it, so proxies that rewrite Host and the Home Assistant integration's proxy still match.
* apply runtime role changes to jsmpeg streams
The output process never subscribed to config/auth, so role edits from the Roles UI (requires_restart 0) did not reach it and jsmpeg kept streaming cameras that had been removed from a role until restart. The output process now replaces its auth config on config/auth updates, which the camera and birdseye broadcast threads read through the shared config.
* tidy origin check docstring and auth update comment
* reject cross-origin go2rtc stream requests in /auth
The go2rtc websockets and the webrtc offer POST still accepted any Origin, since go2rtc runs with origin "*" and /auth grants admin on the internal port, so a page on another site could pull live video through a LAN user's browser. nginx now passes Origin, Host, X-Forwarded-Host and Upgrade to /auth, which rejects a websocket upgrade or go2rtc stream request with a foreign Origin before the internal-port early return. The hostname rule moves to frigate/util/origin.py so /auth and the ws4py servers share it.
* set Host in the nginx proxy doc examples
* drain all queued auth updates in the output process
* note that cards must stream through the integration proxy
* strip the query before matching go2rtc paths in the origin check
* Include HAProxy example in reverse proxy guide
Added HAProxy configuration example for reverse proxy setup.
* Revise HAProxy config and add OPNSense guide
Updated HAProxy configuration details and added a guide for OPNSense HAProxy add-on setup.
* Revise HAProxy configuration steps in guide
Updated the step-by-step guide for configuring HAProxy on OPNSense, ensuring clarity and consistency in instructions.
* Update note on port 443 request forwarding
Clarified note about forwarding requests on port 443 and provided guidance on creating rules and conditions for multiple websites.
* Fix proxy mode description and bind command typo
Corrected the proxy mode description from Layer 7 to Layer 4 and fixed a typo in the bind command.
* Clarify Layer 4 proxy configuration details
Added note about changing hdr(host) to req.ssl_sni for TCP traffic.
* refactor go2rtc docs
* clarify go2rtc language in live
* add export docs
* Move around config items to reflect reference config is now for advanced users
* Remove outdated ipv6 section
* Fix broken links
* live usage docs
* review usage docs
* history usage
* explore usage
* add usage sidebar and move related text to usage sections
* update links
* update live
* move exports to usage
* fix anchors
* Make starts of usage pages consistent
* refactor network config
* Adjustments for review
* Add AI details to history page
* describe alerts vs detections in review usage
* simplify
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* reload the window on 401
* backend apis for auth
* add login page
* re-enable web linter
* fix login page routing
* bypass csrf for internal auth endpoint
* disable healthcheck in devcontainer target
* include login page in vite build
* redirect to login page on 401
* implement config for users and settings
* implement JWT actual secret
* add brute force protection on login
* add support for redirecting from auth failures on api calls
* return location for redirect
* default cookie name should pass regex test
* set hash iterations to current OWASP recommendation
* move users to database instead of config
* config option to reset admin password on startup
* user management UI
* check for deleted user on refresh
* validate username and fixes
* remove password constraint
* cleanup
* fix user check on refresh
* web fixes
* implement auth via new external port
* use x-forwarded-for to rate limit login attempts by ip
* implement logout and profile
* fixes
* lint fixes
* add support for user passthru from upstream proxies
* add support for specifying a logout url
* add documentation
* Update docs/docs/configuration/authentication.md
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Update docs/docs/configuration/authentication.md
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* adding instructions for Nginix reverse proxy
adding an example of subdomain reverse proxy for nginx
* Update docs/docs/guides/reverse_proxy.md
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* Update docs/docs/guides/reverse_proxy.md
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
* add some descriptions for steps
add more information on each of the reverse proxy sections.
* cleanup
---------
Co-authored-by: Nicolas Mowen <nickmowen213@gmail.com>
Co-authored-by: Blake Blackshear <blakeb@blakeshome.com>
