Assuming the user will not be connecting over vpn, but is both remote and non-technical, how would you expose Jellyfin to them securely?

    • BakedCatboy@lemmy.mlEnglish
      1·
      3 hours ago

      What do you mean viable? The web UI is just an app that is delivered to your browser, it makes more or less the same API requests as an app would make, so IDK why the risk would be lower with an app?

      If an attacker can access the login endpoint for example to brute force or dictionary attack, it doesn’t matter if the web UI is or isn’t accessible if the login endpoint it uses is exposed for an app. The attacker could serve their own copy of the web UI and proxy requests to the API your app connects to. Blocking the html from being served doesn’t make a difference.

        • pushpull@fosstodon.org
          1·
          2 hours ago

          @anon_8675309 @BakedCatboy I think that could be fixed with authentication through host headers (netbird reverse proxy supports that, no idea about pangolin though) but apps should also support adding custom headers on requests

        • BakedCatboy@lemmy.mlEnglish
          1·
          3 hours ago

          That’s exactly the point I’m getting at. Putting an auth wall doesn’t work with many apps, and if you add exceptions to the API then you’re not really protecting anything.

            • BakedCatboy@lemmy.mlEnglish
              1·
              2 hours ago

              Yes that’s what I would like to advocate for. I did something similar with LunaSea, but often people suggest doing that with Jellyfin and are not aware that almost no apps support it, and that adding exceptions for the API makes you basically as secure as not having it. But people tend to get very defensive when you try to tell them that something won’t work, so I try to phrase it as a question to see if I can get them to understand what the limitations are in a way that’s less confrontational.