Comment on I don't know who needs to hear this, but DO NOT EVER expose Jellyfin to the internet
ReversalHatchery@beehaw.org 1 day agoaaaand now you smart tv can’t connect. none of them. the clients dont even support http basic auth creds put into the URL for some crazy reason.
for advanced HTTP-level authentication you would need to run a reverse proxy on the TV’s network that would add the authentication info. for the VPN idea you would need to tunnel the TV’s network’s internet connection at the router. or set up a gateway address in the TVs network settings that would do that. or use a reverse proxy here too so that it repeats the request to the real server.
but honestly, this is the real and only secure way anyway. I wouldn’t be comfortable to expose jellyfin even if the devs are real experts. I mean vulns get discovered, in dotnet, jellyfin dependencies, linux filesystem, and reverse proxy, and honestly who has time to always tightly keep up to date with all that.
that’s not to discount the seriousness of the issue though, it’s a real shame that jellyfin is so much against security
t3rmit3@beehaw.org 13 hours ago
Your smart TV is (presumably) on your local network, so you should be routing the requests locally, not through the VPN/ tunnel.
ReversalHatchery@beehaw.org 10 hours ago
often, but not always. sometimes the TV is at a different house, when you are a guest or at a second property
t3rmit3@beehaw.org 4 hours ago
In which case there are still ways to make it work, like putting in an SSO bypass rule for the IP of your other property. Point is, under no circumstances is it impossible to both have it be protected against scanning attacks like the ones described in the article, and keep it available to use over the internet for authorized users.