[Support]: Access allowed to URLs when not authenticated

[e10kstarfire]

Describe the problem you are having

I am using Frigate behind a reverse proxy, passing all requests to frigate on port 8971.

I assumed that if you are not logged in then all HTTP requests apart from trying to login would be denied (HTTP 401), but I see that's not the case.

eg.
without being logged in, I can receive data back (HTTP 200) from URLs like these:

https://myfrigate.example.server/locales/en/views/system.json
https://myfrigate.example.server/assets/index-ADwqpRot.css

etc

Is this expected?

Version

0.17.1-416a9b7

What browser(s) are you using?

Firefox 149.0

Frigate config file

auth:
  failed_login_rate_limit: 1/second;5/minute;20/hour
  trusted_proxies:
    - 172.18.0.0/16

Relevant Frigate log output

n/a

Relevant go2rtc log output

n/a

FFprobe output from your camera

n/a

Frigate stats

No response

Install method

Docker Compose

docker-compose file or Docker CLI command

unRAID Container

Object Detector

CPU (no coral)

Network connection

Wired

Camera make and model

n/a

Screenshots of the Frigate UI's System metrics pages

No response

Any other information that may be helpful

No response

[inkeep-ai-assistant[bot]]

Yes, this is expected behavior. Static assets like CSS files, JavaScript bundles, and locale/translation JSON files are served without authentication. These are frontend resources needed to render the login page itself—without them, users wouldn't even be able to see or interact with the login form.

The authentication in Frigate protects API endpoints and sensitive data, not the static files required to display the UI.(1)

When you access port 8971 (the authenticated port), Frigate validates authentication for API requests and protected resources.(1) However, the static assets under /assets/ and /locales/ are intentionally accessible so the login page can load properly.

Your configuration looks correct for a reverse proxy setup:

auth:
  failed_login_rate_limit: 1/second;5/minute;20/hour
  trusted_proxies:
    - 172.18.0.0/16

(1), (2)

The key security boundary is that unauthenticated users cannot access camera feeds, recordings, API data, or configuration—those require valid authentication via JWT token or proxy headers.(1)

📚 Sources:

1. Authentication
2. Full Reference Config

---

Have another question? Just tag @inkeep.