Jellyfin-android: Issue connecting remotely with Traefik 2.0 and http basic auth

[obbardc]

Describe the bug
Using Traefik 2 setup as a HTTPS proxy with a http basic auth for all connections, Jellyfin for Android can't connect.
This is the same with the Play store version and the latest RC released in this repository.
The web interface works fine when using a browser.

To Reproduce

1. Setup Traefik proxy with http basic auth
2. Set hostname in Jellyfin app to the address
3. Press connect
4. See error "connection couldn't be established"

Expected behavior

The app to connect.

Logs

Screenshots

System (please complete the following information):

• App version: 2.0.0-rc.5
• Android version: Android 10
• Device manufacturer and model: OnePlus 6T
• Jellyfin server version: master
• The type of video player implementation used: web player

Additional context

[nielsvanvelzen]

We can't use the Authorization header for basic authentication because it's used for Jellyfin credentials. A solution I can think of is to use the Proxy-Authenticate header for this but I don't know if Traefik supports it and it will probably not work from within the webui.

[obbardc]

Right - the Traefik http basic auth is just another layer of added security. I expect to have to login twice. The Jellyfin webui works perfectly with separate logins, so in the first instance I'd like to replicate that on mobile app.

I'm currently on vacation, but Ill do some further digging once I am back at the desk ;-).

[obbardc]

For my reference later, here's some info about Android webview handling http basic auth: https://stackoverflow.com/questions/4220832/how-to-handle-basic-authentication-in-webview

[obbardc]

Here's the backtrace, it looks like the issue is with the Jellyfin java API rather than this app.

D/TimberLogger: Adding request to queue: https://jellyfin.<my_host>//System/Info/Public?format=json
E/Volley: [45297] BasicNetwork.performRequest: Unexpected response code 401 for https://jellyfin.<my_host>//System/Info/Public?format=json
E/TimberLogger: VolleyError com.android.volley.AuthFailureError: null
    com.android.volley.AuthFailureError
        at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:195)
        at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:131)
        at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:111)
        at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:90)
E/ContinuationResponse: org.jellyfin.apiclient.model.net.HttpException: VolleyError com.android.volley.AuthFailureError: 
        at org.jellyfin.apiclient.interaction.VolleyErrorListener.onErrorResponse(VolleyErrorListener.java:25)
        at com.android.volley.Request.deliverError(Request.java:617)
        at com.android.volley.ExecutorDelivery$ResponseDeliveryRunnable.run(ExecutorDelivery.java:104)
        at android.os.Handler.handleCallback(Handler.java:883)
        at android.os.Handler.dispatchMessage(Handler.java:100)
        at android.os.Looper.loop(Looper.java:214)
        at android.app.ActivityThread.main(ActivityThread.java:7682)
        at java.lang.reflect.Method.invoke(Native Method)
        at com.android.internal.os.RuntimeInit$MethodAndArgsCaller.run(RuntimeInit.java:516)
        at com.android.internal.os.ZygoteInit.main(ZygoteInit.java:950)
     Caused by: com.android.volley.AuthFailureError
        at com.android.volley.toolbox.BasicNetwork.performRequest(BasicNetwork.java:195)
        at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:131)
        at com.android.volley.NetworkDispatcher.processRequest(NetworkDispatcher.java:111)
        at com.android.volley.NetworkDispatcher.run(NetworkDispatcher.java:90)

[mxvin]

I experience similar issue on version 2.0.0-rc.5 - latest beta playstore, but I'm not using any HTTP Basics.
Just Jelly behind nginx. Cannot connect to HTTPS (nginx) with app saying 'Connection cannot be established.....'.
Turning off h2 have no effect, no log from Jelly and nginx so I suspect this may a problem on HTTPS implementation in the app.
No problem if directly connect to Jellyfin via HTTP

[nielsvanvelzen]

@mxvin Please provide app logs

@obbardc the apiclient is currently ongoing a big refactor and it's behavior might change. The error from your logs basically says that no credentials were given when retrieving server info (which is caused by your proxy since the public endpoint doesn't require authentication at all and thus the apiclient won't provide them).

[alexandre-abrioux]

It would be great to be able to input the basic auth directly in the URL, like this: https://user:[email protected]/.
I don't have any knowledge with Kotlin but looking at the code we would probably need to parse the URL before loading the webview:
https://github.com/jellyfin/jellyfin-android/blob/2e6983c731139aad7458581fdb69e888e3ef6998/app/src/main/java/org/jellyfin/mobile/fragment/WebViewFragment.kt#L202
; and handle auth with the onReceivedHttpAuthRequest listener.

[nielsvanvelzen]

Like I said before, The HTTP Basic Authentication Scheme uses the Authorization header in HTTP requests which is already used for Jellyfin account authorization. We can't add basic auth on top of that.

[alexandre-abrioux]

Thanks. I tried to get more info from my setup where it's actually working behind basic auth.

Jellyfin apparently allows the use of the X-Emby-Authorization header to pass the authentication token, see:
https://github.com/jellyfin/jellyfin/blob/4a3411cad17c95f3afe0870a1ff3a9afc10286fa/Emby.Server.Implementations/HttpServer/Security/AuthorizationContext.cs#L211

The web-ui uses this header instead of the Authorization, see the Javascript client code:
https://github.com/jellyfin/jellyfin-apiclient-javascript/blob/e2c51b2c67e73dfb1e736cbbfc84d73165f5968a/src/apiClient.js#L177

The Kodi plugin also started to use this header since this PR:
https://github.com/jellyfin/jellyfin-kodi/pull/56/files

Is it something we could replicate in the Java client?

[nielsvanvelzen]

We have decided to use the Authorization header because it is a common standard. We will not change it to use the X-Emby-Authorization header.

[alexandre-abrioux]

I agree with that, but we could switch to it if we detect basic auth in the input URL, that could be a great compromise, what do you think?

[KillerKelvUK]

Sorry for the noob question but is this issue where the android app fails to connect because of traefik http basic auth being used or is there a general compatibility issue with traefik and the mobile app?

I ask as I'm just dipping my toe into traefik with jelly and am successfully reverse proxying to a public domain but the app on my OnePlus6 just won't connect. I'm not using http basic auth but I confuss I'm not very experienced so some of the details in this thread are a little beyond me at the moment.

[obbardc]

Sorry for the noob question but is this issue where the android app fails to connect because of traefik http basic auth being used or is there a general compatibility issue with traefik and the mobile app?

I ask as I'm just dipping my toe into traefik with jelly and am successfully reverse proxying to a public domain but the app on my OnePlus6 just won't connect. I'm not using http basic auth but I confuss I'm not very experienced so some of the details in this thread are a little beyond me at the moment.

the jellyfin app works fine with traefik. Suggest you should post your configuration files in full detail in their forum for more help - here isn't really the place to discuss that :-).