mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-05-04 18:09:12 +03:00
[Question]: Is being able to download without account intended? #4737
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @Emporea on GitHub (Mar 27, 2023).
Please describe your bug
Is it intended that you can download any file, regarding of being logged into jellyfin or not, given the link?
Even if the possible combinations of alpha-numeric characters are pretty high its still possible to just download without any account.
https://jelly.example.tld/Items/69d5e4f61ff1a70e47775feb6d25db31/Download?api_key=fe70149b3b7147bc8a99006af1952770Is there a way for me to disable this?
Jellyfin Version
10.8.0
if other:
No response
Environment
No response
Jellyfin logs
No response
FFmpeg logs
No response
Please attach any browser or client logs here
No response
Please attach any screenshots here
No response
Code of Conduct
@nielsvanvelzen commented on GitHub (Mar 27, 2023):
Your example includes your personal access token so it does use authentication.
@Emporea commented on GitHub (Mar 27, 2023):
Allright. This makes sense. Sorry😳