fix(jellyfin): support Jellyfin 12 authorization (v1.6.1) - #129
Merged
Merged
Conversation
Jellyfin 12.0 disables legacy authorization by default and a migration turns it off on existing installs too, so the X-MediaBrowser-Token header and the api_key query parameter no longer authenticate. Every Jellyfin request came back 401 after the upgrade. Switch to the standard Authorization header with the MediaBrowser scheme via a shared jellyfinAuthHeaders() helper, and move the WebSocket handshake to the ApiKey query parameter. Both are accepted by 10.10.x and 12.x, so no version switch is needed. The helper rejects a missing or malformed API key instead of sending a well-formed header with a wrong token, which would only surface as a generic 401. WebSocket auth rejections now log the actual reason rather than looping silently on reconnect. Also stop passing raw axios errors to the logger on the Jellyfin paths: the serialized error carries config.headers, which would write the Authorization header to disk in cleartext.
retardgerman
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
Jellyfin 12.0 disables legacy authorization by default, and its migration turns it off on existing installs too. Anchorr authenticated only via
X-MediaBrowser-Tokenand theapi_keyquery parameter, so every Jellyfin request returned401after upgrading: no notifications, no library list, no WebSocket.Fix
Authorization: MediaBrowserheader, the WebSocket handshake usesApiKey. Both work on 10.10.x and 12.x, so no config change is needed.401.config.headerswrote the auth header intologs/in cleartext.