470
Jellyfin over the internet (startrek.website)
submitted 1 year ago by to c/selfhosted@lemmy.world
265 comments fedilink hide all child comments
 

What’s your go too (secure) method for casting over the internet with a Jellyfin server.

I’m wondering what to use and I’m pretty beginner at this

you are viewing a single comment's thread
view the rest of the comments
[–] 9 points 1 year ago (1 child)

The issue is not encryption, it's the unauthenticated API. People can interact with your server without an account.

  • permalink
  • fedilink
  • source
  • parent
  • hideshow 1 child comment
    •
  • [–] 3 points 1 year ago

    Specifically these issues: https://github.com/jellyfin/jellyfin/issues/5415

    The big one is that video/audio playing endpoints can be used without authentication. However, you have to guess a UUID. If Jellyfin is using UUIDv4 (fully random), then this shouldn't be an issue; the search space is too big. However, many of the other types of UUIDs could hypothetically be enumerated through brute force. I'm not sure what Jellyfin uses for UUIDs.

  • permalink
  • fedilink
  • source
  • parent