Live updates in the web interface need a signed-in session

If you only use the web interface in a browser, nothing changes for you. This only matters if you turned on authentication and run a script or dashboard of your own that listens for the web interface's live updates: from Anthias 2026.09.0, it has to sign in first.

The web interface keeps the asset list current through a WebSocket connection at /ws. When authentication is turned on, Anthias 2026.09.0 accepts that connection only from a browser with a signed-in session, the same rule every page of the web interface already follows. A browser you use the web interface in is already signed in, so nothing changes there. If you run Anthias without authentication, which is the default, /ws stays open as before.

Turning authentication on or off, or changing the username or password, closes the open connections. The web interface reconnects by itself and has to pass the new settings to get back in.

If you run Anthias with authentication on, upgrade to get this.

If this affects you: with authentication on, a script, dashboard or other client that opens /ws without signing in is refused from 2026.09.0, with a 403 at the handshake. Username and password sent as HTTP Basic credentials aren't accepted on /ws either, even though the API still takes them. Sign in through the web interface's login page and send the session cookie you get with the handshake.