[PR #9408] Fix auth endpoints using api key #12101

New Issue

OVERLORD · 2026-02-07T06:50:00+03:00

OVERLORD commented

2026-02-07 06:50:00 +03:00

Original Pull Request: https://github.com/jellyfin/jellyfin/pull/9408

State: closed
Merged: Yes

Changes:

Api keys aren't tied to a user so succeed the requirement before checking for user permissions.

Fixes the following exception:

[20:13:22] [ERR] [143] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL GET /Library/VirtualFolders.
System.ArgumentException: Guid can't be empty (Parameter 'id')
   at Jellyfin.Server.Implementations.Users.UserManager.GetUserById(Guid id)
   at Jellyfin.Api.Auth.DefaultAuthorizationPolicy.DefaultAuthorizationHandler.HandleRequirementAsync(AuthorizationHandlerContext context, DefaultAuthorizationRequirement requirement)
   at Microsoft.AspNetCore.Authorization.AuthorizationHandler`1.HandleAsync(AuthorizationHandlerContext context)
   at Microsoft.AspNetCore.Authorization.DefaultAuthorizationService.AuthorizeAsync(ClaimsPrincipal user, Object resource, IEnumerable`1 requirements)
   at Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluator.AuthorizeAsync(AuthorizationPolicy policy, AuthenticateResult authenticationResult, HttpContext context, Object resource)
   at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext)
   at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider)
   at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context)
   at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext)
   at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext)
   at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context)
   at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager)
   at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context)

**Original Pull Request:** https://github.com/jellyfin/jellyfin/pull/9408 **State:** closed **Merged:** Yes --- ### Changes: Api keys aren't tied to a user so succeed the requirement before checking for user permissions. Fixes the following exception: ``` [20:13:22] [ERR] [143] Jellyfin.Api.Middleware.ExceptionMiddleware: Error processing request. URL GET /Library/VirtualFolders. System.ArgumentException: Guid can't be empty (Parameter 'id') at Jellyfin.Server.Implementations.Users.UserManager.GetUserById(Guid id) at Jellyfin.Api.Auth.DefaultAuthorizationPolicy.DefaultAuthorizationHandler.HandleRequirementAsync(AuthorizationHandlerContext context, DefaultAuthorizationRequirement requirement) at Microsoft.AspNetCore.Authorization.AuthorizationHandler`1.HandleAsync(AuthorizationHandlerContext context) at Microsoft.AspNetCore.Authorization.DefaultAuthorizationService.AuthorizeAsync(ClaimsPrincipal user, Object resource, IEnumerable`1 requirements) at Microsoft.AspNetCore.Authorization.Policy.PolicyEvaluator.AuthorizeAsync(AuthorizationPolicy policy, AuthenticateResult authenticationResult, HttpContext context, Object resource) at Microsoft.AspNetCore.Authorization.AuthorizationMiddleware.Invoke(HttpContext context) at Jellyfin.Api.Middleware.QueryStringDecodingMiddleware.Invoke(HttpContext httpContext) at Swashbuckle.AspNetCore.ReDoc.ReDocMiddleware.Invoke(HttpContext httpContext) at Swashbuckle.AspNetCore.SwaggerUI.SwaggerUIMiddleware.Invoke(HttpContext httpContext) at Swashbuckle.AspNetCore.Swagger.SwaggerMiddleware.Invoke(HttpContext httpContext, ISwaggerProvider swaggerProvider) at Microsoft.AspNetCore.Authentication.AuthenticationMiddleware.Invoke(HttpContext context) at Jellyfin.Api.Middleware.RobotsRedirectionMiddleware.Invoke(HttpContext httpContext) at Jellyfin.Api.Middleware.LegacyEmbyRouteRewriteMiddleware.Invoke(HttpContext httpContext) at Microsoft.AspNetCore.ResponseCompression.ResponseCompressionMiddleware.InvokeCore(HttpContext context) at Jellyfin.Api.Middleware.ResponseTimeMiddleware.Invoke(HttpContext context, IServerConfigurationManager serverConfigurationManager) at Jellyfin.Api.Middleware.ExceptionMiddleware.Invoke(HttpContext context) ```

OVERLORD added the pull-request label 2026-02-07 06:50:00 +03:00

OVERLORD closed this issue

2026-02-07 06:50:02 +03:00

OVERLORD referenced this issue

2026-02-07 07:07:27 +03:00

[PR #12251] [MERGED] Add unit tests for PremiereDateComparer #13118

OVERLORD referenced this issue

2026-02-07 07:12:14 +03:00

[PR #12859] Order using production year when premiere date is not available #13397

OVERLORD referenced this issue

2026-02-07 07:17:21 +03:00

[PR #13733] [MERGED] Fix Sort by Year Bug (#12101) #13683