SOLVED: Android App not connecting anymore

[bkl842]

Until a few days ago, I was unable to connect remotely to my server with the Android tv app, although the web interface worked as did the iOS app. I was also able to connect with the Kodi plugin, but it was very slow to start playback (a minute 30 seconds+) or to list directory contents. I opened an issue on GitHub, and one of the suggestions was to disable http/2 and gzip. After doing that, the lag on Kodi was resolved, and I can also connect remotely with the Android tv app. Even after re-enabling http/2 and gzip. Not sure why it worked, but it’s worth a try.

[holger_kuehn]

Hi,

have done some more digging and testing. This seems to be caused by one or more of those headers, will narrow them down tomorrow (just a quik note today):

Code:

    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
    Header always set Content-Security-Policy "default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'self' dachs.blog"
    Header always set Feature-Policy "geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self'"

I suspect the Content-Security-Policy, as it should block scripts, will update as soon as I've tested this.

[holger_kuehn]

For reference, the Android App is blocked from connecting when the proxy adds a Content-Security-Policy-Header that blocks outside sources and those are used by skins for example. This was the case here as I used Ultrachromic skin via Skin Manager.
The following virtual host is working as expected, and honoring most best practices from pentest-tools.com:

Code:

<VirtualHost *:443>
    ServerName domain.tld
    DocumentRoot "${SRVROOT}/htdocs/jellyfin"
    ErrorLog "${SRVROOT}/logs/jellyfin_error.log"
    CustomLog "${SRVROOT}/logs/jellyfin_access.log" combined
    ProxyPreserveHost On
    ProxyPass "/.well-known/" "!"
   
    # Tell Jellyfin to forward that requests came from TLS connections
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ProxyPass "/socket" "ws://localhost:8096/socket"
    ProxyPassReverse "/socket" "ws://localhost:8096/socket"
    ProxyPass "/" "http://localhost:8096/"
    ProxyPassReverse "/" "http://localhost:8096/"

    SSLEngine on
    SSLCertificateFile "${SRVROOT}/conf/ssl.crt/server.crt"
    SSLCertificateKeyFile "${SRVROOT}/conf/ssl.key/server.key"
    SSLCertificateChainFile "${SRVROOT}/conf/ssl.fullchain/fullchain.pem"
    Protocols h2 http/1.1

    ### Add headers ###
    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"

    Header always set Content-Security-Policy "default-src 'self' dachs.blog; script-src 'self' 'unsafe-inline' dachs.blog www.gstatic.com/cv/js/; style-src 'self' 'unsafe-inline' dachs.blog cdn.jsdelivr.net/gh/CTalvio ctalvio.github.io fonts.googleapis.com/css2; connect-src 'self' dachs.blog; object-src 'none'; worker-src 'self' dachs.blog; frame-ancestors 'self' dachs.blog; base-uri 'self' dachs.blog"

    Header always set Feature-Policy "geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self'"

    RewriteEngine on
    RewriteRule ^/web/robots.txt https://domain.tld/robots.txt [L,R=301]
    RewriteRule ^/.well-known/security.txt https://domain.tld/.well-known/security.txt [L,R=301]
</VirtualHost>

[beankylla]

Hello,

I am experiencing a similar issue with a slightly different setup:

I am running jellyfin in docker behind nginx proxy manager.

[*]From the browser it always works flawlessly regardless of the origin

[*]with the android app:

• From my home i can always connect with ip + port no issues
  
• From my home connecting with Domain name does not work, EXCEPT when i connect to a  VPN, then the connection goes through and then i can disconnect from the vpn and it keeps working (i fail to understand the logic, maybe issue is only with the login?)
  
• From other places: it refuses to connect EXCEPT when i use the same VPN as at Home
  

Once successfully connected app works OK, even from a location that i could not connect from

I experience a different behavior with the flatpak app: connects OK from my computer whereas the androidTV box will refuse to connect.

Would be happy to provide any elements that would help

[TheDreadPirate]

Can you share screenshots of all the tabs for Nginx Proxy Manager? Censor the domain.

[esjaysee]

Maybe it's time to use Caddy? It just seems to work better for reverse proxies in Windows from my experience. Don't ask me why. But if you need a hand or a sample caddy file let me know.