Jellyfin-android: ExoPlayer requests don't pass cookies

[Aerion]

Describe the bug
ExoPlayer web requests aren't including cookies set by the web-browser.
As I'm using SSO (authelia) to protect my jellyfin instance and it's cookie-based, ExoPlayer requests are unauthenticated.

To Reproduce
_I don't know what would be the simplest way to reproduce the issue. Maybe having a reverse proxy that sets a cookie in the homepage and checks for its existence when accessing /jellyfin/Videos?_

1. Open jellyfin app
2. If first time or SSO token expires, I'm redirected to the SSO login screen
3. Log-in if needed. Starting from here, a cookie has been set by the SSO and I'm always authenticated
4. Using the web-based player, playing a video simply works
5. Using the ExoPlayer, playing a video doesn't work and I can see in the SSO's logs that the user isn't identified, thus access is denied and ExoPlayer screen is just blank.

Expected behavior
I expect that playing a video with either ExoPlayer or web-based one works.
Using the same cookies that are used in the webview should fix the issue.

Logs
Authelia logs (we can see that user isn't authenticated as the username is empty)

authelia    | time="2021-01-02T17:03:21+01:00" level=info msg="Access to /jellyfin/Videos/<id>/stream.mkv?Static=true&mediaSourceId=<id>&deviceId=<id>&api_key=<id>&Tag=<id> is not authorized to user '', redirecting to <authelia url>" method=GET path=/api/verify remote_ip=<ip>
authelia    | time="2021-01-02T17:03:21+01:00" level=info msg="Access to /jellyfin/Sessions/Playing/Progress is not authorized to user '', redirecting to <authelia url>" method=GET path=/api/verify remote_ip=<ip>

Screenshots

System (please complete the following information):

• App version: 2.2.3
• Android version: Android 10
• Jellyfin server version: 10.6.4
• The type of video player implementation used: web player works, ExoPlayer doesn't

Additional context

                                +--------------+            +--------+
   Web request       +--------> |SSO (authelia)+----------->+Jellyfin|
   targeting Jellyfin           +--------------+            +--------+
                                       |
                                       |Based on a cookie
                                       v
                                +----------------+
                                |SSO login portal|
                                |if user isn't   |
                                |authenticated   |
                                +----------------+

[nielsvanvelzen]

This is not something we're going to support. We're slowly migrating to a fully native apps and all native components do not support this.

[Aerion]

It may be naive, but from my point of view it, supporting this would "just" mean to get the cookies from the webview and pass them to exoplayer and other http requests (if any are made).

I'm not familiar with ExoPlayer, but from what I saw, this would be feasible (https://github.com/google/ExoPlayer/issues/4870#issuecomment-425795374 or https://github.com/google/ExoPlayer/issues/8386).

1. Would you reconsider supporting it?
2. When you are talking about native components, are you talking about mx player/vlc and excluding ExoPlayer?
3. Would this mean that the url of the streamed media must be without any authentication?

In any case, thanks for your work :)

[nielsvanvelzen]

With "a fully native app" I meant that we're removing the webview and implement the user interface using standard Android methods. This means that we won't don't use the website anymore and instead request all API endpoints from the app.
Those requests are made using our apiclient which does not support setting custom cookies and there is no intention to add this.

If you really want to add an extra security layer to your Jellyfin server you should look into an ip whitelist/blacklist or using passwords for your Jellyfin users. We _might_ support proxy authentication in the future, but no promises on that.