Auth header for API is now prefixed with X- to follow spec

README.md

@@ -245,7 +245,7 @@ Home Assistent runs a webserver accessible on port 8123.
 
 In the package `homeassistant.remote` a Python API on top of the HTTP API can be found.
 
-The API accepts and returns only JSON encoded objects. All API calls have to be accompanied by the header "HA-Access" with as value the api password (as specified in `home-assistant.conf`).
+The API accepts and returns only JSON encoded objects. All API calls have to be accompanied by the header "X-HA-Access" with as value the api password (as specified in `home-assistant.conf`).
 
 Successful calls will return status code 200 or 201. Other status codes that can return are:
  - 400 (Bad Request)

homeassistant/components/http/frontend.py

@@ -1,2 +1,2 @@
 """ DO NOT MODIFY. Auto-generated by build_frontend script """
-VERSION = "f0d938f2a01a613e9fa0beb44940713d"
+VERSION = "b32f2de4e3336946fe68cd1e5cd0fe6f"

homeassistant/components/http/www_static/polymer/home-assistant-api.html

@@ -69,10 +69,6 @@
     events: [],
     stateUpdateTimeout: null,
 
-    computed: {
-      ha_headers: '{"HA-access": auth}'
-    },
-
     created: function() {
       this.api = this;
 
@@ -285,7 +281,7 @@
     call_api: function(method, path, parameters, onSuccess, onError) {
       var req = new XMLHttpRequest();
       req.open(method, "/api/" + path, true)
-      req.setRequestHeader("HA-access", this.auth);
+      req.setRequestHeader("X-HA-access", this.auth);
 
       req.onreadystatechange = function() {
 

homeassistant/const.py

@@ -66,7 +66,7 @@ SERVICE_MEDIA_PREV_TRACK = "media_prev_track"
 # #### API / REMOTE ####
 SERVER_PORT = 8123
 
-AUTH_HEADER = "HA-access"
+AUTH_HEADER = "X-HA-access"
 
 URL_API = "/api/"
 URL_API_STATES = "/api/states"