Frigate 暴露面檢視：將攝影機介面與未經驗證的 API 分開

Frigate exposure review: separate the camera UI from the unauthenticated API

Frigate is a network video recorder and object-detection service. It can expose a browser UI, an API, camera streams, and integration endpoints. A visible Frigate title is not enough to describe the exposure because the authenticated and internal listeners intentionally have different security properties.

The Frigate authentication documentation states that the authenticated UI and API use port 8971, while port 5000 provides internal unauthenticated UI and API access. Reverse proxies should use the authenticated port, and access to the internal port should be limited. The documentation also describes proxy-secret and trusted-proxy settings for deployments that terminate authentication upstream.

What the probe observed

The count-only ZoomEye probe ran on 2026-10-30 at about 17:46 UTC with sub_type=all, page 1, and a page size of one. app="Frigate" returned 5,092. title="Frigate" returned 10,541.

The title count can include unrelated pages and cannot show which port is exposed. A public login page at 8971 does not prove that port 5000 is reachable. Conversely, a title match from an internal network can still represent a sensitive camera system.

For an authorized inventory, record the host, TLS certificate, UI port, API path, proxy type, and whether authentication is required. Inspect only metadata needed to classify the service. Do not attempt to view camera streams or object-detection events on systems outside your ownership.

Test the network and proxy path

Confirm that the internal port is bound to a private network or container network and is not reachable from the public interface. If a reverse proxy handles authentication, verify the X-Proxy-Secret, trusted-proxy range, and identity headers together. A proxy that trusts a header from the wrong network can be bypassed.

Review the JWT secret, session length, user roles, and reset procedure. Changing the JWT secret invalidates existing tokens and is a useful containment step after suspected exposure. Ensure that reset credentials are not left in shared logs.

Test the public path with no session, a low-privilege user, and an administrator. Test the internal path from a permitted integration network and from a user workstation. The results should match the deployment diagram.

Frigate can provide useful camera visibility, but the same service can expose recordings and live streams. The review should prove which listener serves the internet and which listener is confined to integrations.