mirror of
https://github.com/jellyfin/jellyfin.git
synced 2026-05-04 18:09:12 +03:00
Video streams completely unauthenticated #774
Reference in New Issue
Block a user
Delete Branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
Originally created by @DMouse10462 on GitHub (Jul 1, 2019).
Describe the bug
This is sort of a roadmap/implementation/opinion question, but will Jellyfin keep video streams completely unauthenticated as they are for the foreseeable future? It was somewhat shocking to discover that Emby/Jellyfin allows streaming of a video (provided you have the ID) without any need for authentication.
On top of this, it appears that no direct URL streaming is logged under Activity, as it appears that only proper clients that register their usage and progress appear here.
To Reproduce
Expected behavior
Logs
This appears to be (previously) expected behavior, so no error logs seem necessary. Let me know if this assumption is wrong.
Screenshots
System (please complete the following information):
Additional context
Reading Emby forums led me to believe that this was an intentional decision in order to allow a wide variety of players (with some comments direct from Luke), but it comes off as quite strange considering there isn't even a form of token authentication keeping unauthorized users from streaming and transcoding.
@ddurdle commented on GitHub (Jul 13, 2019):
This is an issue that was inherited from emby. The streams will take a session parameter, but it is not required. So it is possible for users to stream without authorization. I brought up the issue with emby back in emby 3.5.2.
@normanu commented on GitHub (Feb 25, 2020):
Would this be solved by blocking /Videos/ from the reverse proxy?
This is a pretty big security issue.
@dkanada commented on GitHub (Feb 25, 2020):
@normanu I don't think it would, but I did bring up in chat that we could potentially include an option to disable unauthenticated requests and require manual intervention to enable it. This would probably need an option in the startup wizard and a message on the DLNA page explaining the issue at minimum to get merged.
@angauber commented on GitHub (Jun 11, 2020):
This also affects Images
You can fetch any image given it's id like so:
curl http://server_url/Items/hash_id/Images/Primary/ --output res.jpgOddly for music, this requires the
api_keyparameterI wonder what limits the usage of this token on Images / Videos
@cvium commented on GitHub (Apr 9, 2021):
Consolidating security issues/questions in #5415
@pktiuk commented on GitHub (May 22, 2024):
@cvium
Closing this issue may be misleading for users and developers. Please check comment: https://github.com/jellyfin/jellyfin/issues/5415#issuecomment-2071798575
I think it would be wise to reopen it.
@cvium commented on GitHub (May 22, 2024):
The consolidation was on purpose.
@pktiuk commented on GitHub (May 22, 2024):
Then it should not be closed as
completed, but closed asnot planned.@Bond-009 commented on GitHub (May 22, 2024):
@pktiuk Please don't comment on issues that closed 3 years ago.
Also that feature didn't exist yet when this was closed https://github.blog/changelog/2022-05-19-the-new-github-issues-may-19th-update/