+- Jellyfin Forum (https://forum.jellyfin.org)
+-- Forum: Support (https://forum.jellyfin.org/f-support)
+--- Forum: Troubleshooting (https://forum.jellyfin.org/f-troubleshooting)
+---- Forum: Networking & Access (https://forum.jellyfin.org/f-networking-access)
+---- Thread: CORS Issues - Desktop Windows (/t-cors-issues-desktop-windows)
CORS Issues - Desktop Windows - Royal_Guard - 2025-10-09
Hi,
I've noticed that the desktop app is sending some requests with "file
/" as the Origin.This happens for the websocket (so syncplay doesn't work), and the font files (unless I use a custom theme that uses external ones).
The web app and everything else requests stuff with the correct Origin.
I can fix this by disabling CORS, but that isn't ideal for outside access.
I don't know if this could help, but here's the CSP directive for the reverse proxy (there's a lot of stuff for external stuff like ElegantFin and Editor's Choice. If I disable those the problem doesn't go away) :
Code:
default-src 'self'; script-src 'self' 'unsafe-inline' wasm-unsafe-eval blob: https://www.gstatic.com https://www.youtube.com blob: https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/splide.min.js; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/splide.min.js.map; media-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self';I'll attach the Headers as images.
I've installed Jellyfin with this script.
I'm running Jellyfin on a Proxmox Unpriviledge Container (LXC) that has Ubuntu 24.04.3 LTS on it.
I've syslinked /usr/share/jellyfin/web to /var/lib/jellyfin/wwwroot since it was giving out a warning on the logs.
The logs show basically nothing, the only things that it showed were fixed about 5 minutes ago (the warn for wwwroot missing and a perms issue on usr/share/jellyfin/index.html)
Thanks a lot and I hope I can fix this simple issue.