starred/jellyfin
1
0
Fork 0
mirror of https://github.com/jellyfin/jellyfin.git synced 2026-07-16 05:43:54 +03:00
Code Issues 822 Packages Projects Releases 17 Wiki Activity

[Bug] Assets fail to load behind Basic Auth (/Startup/Configuration & /Localization/Options) #6839

New Issue
Closed
opened 2026-02-07 04:11:22 +03:00 by OVERLORD · 1 comment
OVERLORD commented 2026-02-07 04:11:22 +03:00
Owner
Copy Link

Originally created by @maltfield on GitHub (Mar 23, 2025).

Description of the bug

There is a bug in jellyfin that prevents the user from proceeding from the first step of the installation wizard when jellyfin is placed behind basic auth.

To protect against application or common authentication vulnerabilities, it is common-practice to put websites behind HTTP Basic Auth. This is a layered security measure that eliminates application vulnerabilities from being a vector of compromise.

Fortunately, jellyfin loads fine behind an nginx proxy using basic auth.

Unfortunately, there is a bug in jellyfin that prevents two assets from being loaded -- thus blocking the install wizard from being able to run when loaded behind an nginx proxy using basic auth.

Reproduction steps

  1. Freshly install jellyfin (eg on Debian 12)
  2. Setup nginx following this guide https://jellyfin.org/docs/general/networking/nginx/
  3. Generate an htpasswd file for basic auth username/password
htpasswd -Bc /var/www/.htpasswd jellyfin_username
  1. Update the nginx config to require the user to enter the username/password entered above to access jellyfin. These lines should be placed inside the server{} block, just above the location{} block that passes the traffic back to jellyfin on port 8096
        auth_basic "auth required";
        auth_basic_user_file /var/www/.htpasswd;
  1. Load jellyfin in web browser
  2. See bug: You can't select a language because the dropdown menu of languages is empty

What is the current bug behavior?

Jellyfin cannot be installed. This is because the drop-down menu of languages is empty.

This is because jellyfin fails to load the following asset due to a 401 error:

/Localization/Options

Also note there's another asset that fails to load:

/web/config.json

What is the expected correct behavior?

All assets should load, the dropdown menu (of languages) should be populated, and the user should be able to select a language to continue with the install configuration of jellyfin

Jellyfin Server version

10.10.0+

Specify commit id

No response

Specify unstable release number

No response

Specify version number

10.10.6

Specify the build version

10.10.6

Environment

- OS: Debain 12 Linux
- Linux Kernel: 6.1.0-11-amd64
- Virtualization: No
- Clients:
- Browser: Firefox 128.8.0esr (64-bit)
- FFmpeg Version:
- Playback Method:
- Hardware Acceleration:
- GPU Model:
- Plugins:
- Reverse Proxy: Nginx
- Base URL:
- Networking:
- Storage:

Jellyfin logs

the error occurs client-side

FFmpeg logs

Client / Browser logs

No response

Relevant screenshots or videos

No response

Additional information

No response

Originally created by @maltfield on GitHub (Mar 23, 2025). ### Description of the bug There is a bug in jellyfin that prevents the user from proceeding from the first step of the installation wizard when jellyfin is placed behind basic auth. To protect against application or common authentication vulnerabilities, it is common-practice to put websites behind [HTTP Basic Auth](https://developer.mozilla.org/en-US/docs/Web/HTTP/Guides/Authentication). This is a layered security measure that eliminates application vulnerabilities from being a vector of compromise. Fortunately, jellyfin loads fine behind an nginx proxy using basic auth. Unfortunately, there is a bug in jellyfin that prevents two assets from being loaded -- thus blocking the install wizard from being able to run when loaded behind an nginx proxy using basic auth. ### Reproduction steps 1. Freshly install jellyfin (eg on Debian 12) 2. Setup nginx following this guide https://jellyfin.org/docs/general/networking/nginx/ 3. Generate an htpasswd file for basic auth username/password ``` htpasswd -Bc /var/www/.htpasswd jellyfin_username ``` 4. Update the nginx config to require the user to enter the username/password entered above to access jellyfin. These lines should be placed inside the `server{}` block, just above the `location{}` block that passes the traffic back to jellyfin on port 8096 ``` auth_basic "auth required"; auth_basic_user_file /var/www/.htpasswd; ``` 5. Load jellyfin in web browser 6. See bug: You can't select a language because the dropdown menu of languages is empty ### What is the current _bug_ behavior? Jellyfin cannot be installed. This is because the drop-down menu of languages is empty. *This* is because jellyfin fails to load the following asset due to a 401 error: ``` /Localization/Options ``` Also note there's another asset that fails to load: ``` /web/config.json ``` ### What is the expected _correct_ behavior? All assets should load, the dropdown menu (of languages) should be populated, and the user should be able to select a language to continue with the install configuration of jellyfin ### Jellyfin Server version 10.10.0+ ### Specify commit id _No response_ ### Specify unstable release number _No response_ ### Specify version number 10.10.6 ### Specify the build version 10.10.6 ### Environment ```markdown - OS: Debain 12 Linux - Linux Kernel: 6.1.0-11-amd64 - Virtualization: No - Clients: - Browser: Firefox 128.8.0esr (64-bit) - FFmpeg Version: - Playback Method: - Hardware Acceleration: - GPU Model: - Plugins: - Reverse Proxy: Nginx - Base URL: - Networking: - Storage: ``` ### Jellyfin logs ```shell the error occurs client-side ``` ### FFmpeg logs ```shell ``` ### Client / Browser logs _No response_ ### Relevant screenshots or videos _No response_ ### Additional information _No response_
OVERLORD added the bug label 2026-02-07 04:11:22 +03:00
OVERLORD commented 2026-02-07 04:11:27 +03:00
Author
Owner
Copy Link

@crobibero commented on GitHub (Mar 23, 2025):

Jellyfin doesn't support basic auth, so this is not a bug.

@crobibero commented on GitHub (Mar 23, 2025): Jellyfin doesn't support basic auth, so this is not a bug.
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
EFjellyfin.db
area:database
awaiting-feedback
backend
blocked
breaking change: web api
bug
build
ci
confirmed
discussion needed
dotnet future
downstream
duplicate
enhancement
feature
future
github-actions
good first issue
hdr
help wanted
invalid
investigation
librarydb
live-tv
lyrics
media playback
music
needs testing
nuget
performance
platform
pull-request
Mirrored from GitHub Pull Request
 question
regression
release critical
requires-web
roadmap
security
security
stale
support
syncplay
ui & ux
upstream
wontfix
No Label bug
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
OVERLORD
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/jellyfin#6839
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?