SOLVED: MKV files wont play in Android client app when accessed through NGINX reverse proxy

[stiw47]

Ok, after more trial and errors, I found it. Actually, it was not related to any of the:

Code:

add_header X-XSS-Protection "1; mode=block" always;
add_header X-Frame-Options SAMEORIGIN always;
add_header Referrer-Policy "no-referrer" always;

And all 3 ^ are uncommented now, mkv play is working. It was related to the CSP which I skipped to post here. Yeah, I have it also, and it is (IMHO) little idiotic long, TBH I am still learning about it and trying to find some optimal way....
Anyway, started ADB logcat to live monitor Jellyfin apk log when reproduce mkv error:

Code:

$ adb logcat | grep -F "`adb shell ps | grep org.jellyfin.mobile | tr -s [:space:] ' ' | cut -d' ' -f2`"

Found this in log:

Code:

02-24 19:29:24.082 14351 14351 E WebView : Refused to load media from 'blob:https://jellyfin.example.com/e48a257b-0c37-4e73-951f-5d5f9abce829' because it violates the following Content Security Policy directive: "default-src 'self'". Note that 'media-src' was not explicitly set, so 'default-src' is used as a fallback.

After several trials and errors where and what should be put, ended with this in NGINX CSP:

Code:

add_header Content-Security-Policy "default-src 'self'; media-src 'self' blob: https://example.com https://*.example.com; img-src.... etc. etc. insanely long....

Will need to check/monitor now what else will be broken 😂, since I did not used media-src in CSP before 😂.