mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-05-04 18:09:12 +03:00
Video streams unauthenticated (VideosController, HlsSegmentController, LiveTVController) #6952
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @felix920506 on GitHub (Apr 23, 2025).
Split from #5415
Summary: The current implementation allows direct play without authentication. Transcoded media is partially authenticated (old HLS only has metadata protection, new HLS protects all). The Jellyfin web client does provide an api_key parameter in the URL for all some stream types (except HlsSegmentController because the m3u playlist generated doesn't contain parameters), but it isn't checked.
HlsSegmentController has a comment saying "Can't require authentication just yet due to seeing some requests come from Chrome without full query string"
This also applied to streams in LiveTvController endpoints. Those are also not authenticated. Update: Appears to be resolved in 10.8.9
Potential fix: Require authentication on all video streams, both direct streams as well as any transcoded media.