[Question]: Conditions under which frigate 0.14 PWA/webui logs out

[rajil]

What is your question:

The frigate 0.14 app does not offer any way to save the password. Most of the times it does not ask the password. However, there are times when it logs me out and asks for a password. Is there any reason why a user may get logged out?

I am doing testing with frigate by upgrading or downgrading the docker package. Is that the reason why i get logged out?

I have not modified delete the database so far. Are the username/password stored in the database?

Thanks

[NickM-27]

I believe it can depend on what directories are mapped in docker.

That said frigate definitely supports password autofill for me, only had to type the password once

[rajil]

I did not modify the docker compose file except changing the container image version.

Is there any volume which needs to be mounted to keep the password static?

[blakeblackshear]

You should not have to login or reset a password when restarting frigate or pulling a new image. I do this many times per day without logging out. You should provide your config and docker compose.

[rajil]

This is my docker compose

services:
  frigate:
    container_name: frigate
    privileged: true 
    restart: unless-stopped
    image: ghcr.io/blakeblackshear/frigate:dev-bdda89b
    shm_size: "512mb" # update for your cameras based on calculation above
    devices:
      - /dev/bus/usb:/dev/bus/usb  # Passes the USB Coral, needs to be modified for other versions
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /home/ubuntu/dockerdata/volumes/frigate/config:/config
      - /mnt/drive/frigatemedia:/media/frigate
      - /dev/webcam0:/dev/webcam0
      - type: tmpfs # Optional: 1GB of memory, reduces SSD/SD Card wear
        target: /tmp/cache
        tmpfs:
          size: 1000000000
    ports:
      - "192.168.1.5:8088:8080"
      - "192.168.1.5:5000:5000"
      - "192.168.1.5:8554:8554" # RTSP feeds
      - "192.168.1.5:8555:8555/tcp" # WebRTC over tcp
      - "192.168.1.5:8555:8555/udp" # WebRTC over udp
    deploy:    
      resources:
        reservations:
          devices:
            - driver: nvidia
              capabilities: [gpu]
        limits:
          memory: 10000M

Here is my config (left out cameras: and gortc: sections)

mqtt:
  enabled: true
  host: mqtt.myhost.com
  port: 1883
  topic_prefix: frigate
  user: frigate
  password: blahblah

auth:
  failed_login_rate_limit: "1/second;5/minute;20/hour"
  trusted_proxies:
    - 192.168.1.2/32 # <---- this is upstream proxy
    - 10.10.0.0/16  # <---- this is docker internal network

record:
  enabled: true
  sync_recordings: false
  retain:
    days: 7
    mode: all
  events:
    retain:
      default: 30
      mode: active_objects

objects:
  track:
    - person
  filters:
    person:
      threshold: 0.7

snapshots:
  enabled: true
  clean_copy: true
  timestamp: false
  crop: true
  retain:
    default: 20
    objects:
      person: 30

ffmpeg:
  hwaccel_args: preset-nvidia-h264
  output_args:
    record: preset-record-generic-audio-aac

detectors:
  coral:
    type: edgetpu
    device: usb

birdseye:
  enabled: true
  quality: 1
  mode: continuous
  restream: true

camera_groups:
  Outdoor:
    order: 1
    icon: LuCar
    cameras:
      - frontdoor
      - maingate
      - sidealley
  Terrace:
    order: 2
    icon: LuCloud
    cameras:
      - terracefront
      - terraceback
version: 0.14

[blakeblackshear]

Two things to check:

• The last modified date for the .jwt_secret file in your config folder. As long as the contents of this file don't change on a restart/repull then the JWT token in your cookie should remain valid.
• Is the password the same or do you have to reset it? The hash is stored in the database, so if it's the same then the value isn't getting reset on reboot.

You may just simply need to increase the session lengths in the config. By default, you will be required to login again if you go 24 hours or more without accessing Frigate.

# Optional: Authentication configuration
auth:
  ...
  # Optional: Session length in seconds (default: shown below)
  session_length: 86400 # 24 hours
  # Optional: Refresh time in seconds (default: shown below)
  # When the session is going to expire in less time than this setting,
  # it will be refreshed back to the session_length.
  refresh_time: 43200 # 12 hours

For example, I have this in my config:

auth:
  ...
  session_length: 864000 # 10 days
  refresh_time: 776000 # 9 days

[clintebbesen]

I have issues with having to login every day. Generally it stays logged in for a day or so, but it's extremely annoying to have to login. I generally use both my iPhone and my MacBook Pro.

Security cameras are on thing I need very fast access to, if I get an alert someone is there, I want to view that camera as fast as possible, but I cant because I have to struggle to login.

I use Bitwarden, but I have a heap of local servers all using subdomains and for whatever reason Bitwarden shows all passwords for all servers I have, so its multiple taps to open bitwarden, bring up the full list of passwords search for frigate, then populate that password.

if it could just stay logged in that would be great, its frustrating needing to login every day

[clintebbesen]

What is the reason? And also asking again if 31104000 would work or if the value would be too large?

As mentioned 24 hours is way too short for a camera system as you need to have instant access when you get an alert saying someone is there. If there is someone at my shed who shouldn't be there and it takes me 20 seconds to login, that could be 20 seconds too late for me to get to the shed from the house when every moment counts. or same for a delivery driver waiting at the front gate.

[NickM-27]

Why does it take you 20 seconds to log in? When Frigate needs to login it takes one second for my password manager to automatically fill in the details then press login.

And it's only 24 hours of not opening the site. If you open the site more often the token is refreshed without needing to login again.

[NickM-27]

What is the reason? And also asking again if 31104000 would work or if the value would be too large?

It will work, it is also much larger than would be recommended for security reasons

[clintebbesen]

I use Bitwarden, but I have a heap of local servers all using subdomains and for whatever reason Bitwarden shows all passwords for all servers I have, in no particular order. On my iPhone it suggests about 20 or so passwords, and frigate isnt one of those, I have to scroll to the bottom, tap the open Bitwarden button, then search Bitwarden for frigate, then select the password. I wish it was easier but for some reason Bitwarden doesnt work well when you have a heap of different subdomains for different servers.

[ofcedwards]

@clintebbesen you may benefit from changing the match detection on your logins stored in Bitwarden, specifically for logins that all match on the same local ip address. I'd recommend changing the match type to "host" and updating the uri for each login to include the port as well. Unfortunately, the autofill ui on iOS doesn't respect this, so you still have to tap to open the Bitwarden app. But when you do open Bitwarden, it should only show the single login, preventing you from having to search/scroll.

See the Bitwarden docs on match detection for more info. Hopefully they'll fix the autofill ui at some point to respect the match settings (unless it's a limitation by Apple or something).