[Help Needed] How to prevent anonymous access to resources(poster) on Jellyfin server

[TheDreadPirate]

Ah. Posters. I had it in my head you were talking about the actual media. Reading comprehension fail.

That is the current behavior, yes. It is a known issue that requires a significant rework of how images are served.

Here is the github issue that is a sort of "collection of known security issues".

https://github.com/jellyfin/jellyfin/issues/5415

Most are relatively minor. The team has addressed more severe security issues when disclosed, such as privilege escalation vulnerabilities, and unauthenticated access to media.

Some ways to mitigate risk are the following.

1) Hide user names from the login screen (default behavior now, IIRC)
2) Use a reverse proxy and https instead of directly exposing Jellyfin to the Internet
3) Setup fail2ban for both Jellyfin and your reverse proxy to ban repeated login/access failures