CORS Issues - Desktop Windows

[Royal_Guard]

Hi,

I've noticed that the desktop app is sending some requests with "file/" as the Origin.

This happens for the websocket (so syncplay doesn't work), and the font files (unless I use a custom theme that uses external ones).

The web app and everything else requests stuff with the correct Origin.

I can fix this by disabling CORS, but that isn't ideal for outside access.

I don't know if this could help, but here's the CSP directive for the reverse proxy (there's a lot of stuff for external stuff like ElegantFin and Editor's Choice. If I disable those the problem doesn't go away) :

Code:

default-src 'self'; script-src 'self' 'unsafe-inline' wasm-unsafe-eval blob: https://www.gstatic.com https://www.youtube.com blob: https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/splide.min.js; style-src 'self' 'unsafe-inline' https://cdn.jsdelivr.net https://fonts.googleapis.com;    font-src 'self' https://fonts.gstatic.com; img-src 'self' data: https: blob:; connect-src 'self' https://cdn.jsdelivr.net/npm/@splidejs/splide@4.1.4/dist/js/splide.min.js.map; media-src 'self' blob:; object-src 'none'; base-uri 'self'; form-action 'self';

I'll attach the Headers as images.
   

   


I've installed Jellyfin with this script.

I'm running Jellyfin on a Proxmox Unpriviledge Container (LXC) that has Ubuntu 24.04.3 LTS on it.

I've syslinked /usr/share/jellyfin/web to /var/lib/jellyfin/wwwroot since it was giving out a warning on the logs.

The logs show basically nothing, the only things that it showed were fixed about 5 minutes ago (the warn for wwwroot missing and a perms issue on usr/share/jellyfin/index.html)


Thanks a lot and I hope I can fix this simple issue.