Home Assistant

Home Assistant’s Android app limits where it sends credentials

An encrypted address must also belong to a known server before it can receive login details.

With work by

Reviewed by jpelgrom

Home Assistant’s Android app checks that an HTTPS address is a known server before sending it credentials. The existing check accepted every HTTPS address, treating encryption alone as sufficient.

Timothy adds the known-address requirement, with review by Joris Pelgröm.

From the source

home-assistant/android

Only allow usage of credential on known URL for HTTPS