SOLVED: Android App not connecting anymore

[bkl842]

Until a few days ago, I was unable to connect remotely to my server with the Android tv app, although the web interface worked as did the iOS app. I was also able to connect with the Kodi plugin, but it was very slow to start playback (a minute 30 seconds+) or to list directory contents. I opened an issue on GitHub, and one of the suggestions was to disable http/2 and gzip. After doing that, the lag on Kodi was resolved, and I can also connect remotely with the Android tv app. Even after re-enabling http/2 and gzip. Not sure why it worked, but it’s worth a try.

[holger_kuehn]

Hi,

have done some more digging and testing. This seems to be caused by one or more of those headers, will narrow them down tomorrow (just a quik note today):

Code:

    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"
    Header always set Content-Security-Policy "default-src 'none'; script-src 'none'; object-src 'none'; base-uri 'self' dachs.blog"
    Header always set Feature-Policy "geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self'"

I suspect the Content-Security-Policy, as it should block scripts, will update as soon as I've tested this.

[holger_kuehn]

For reference, the Android App is blocked from connecting when the proxy adds a Content-Security-Policy-Header that blocks outside sources and those are used by skins for example. This was the case here as I used Ultrachromic skin via Skin Manager.
The following virtual host is working as expected, and honoring most best practices from pentest-tools.com:

Code:

<VirtualHost *:443>
    ServerName domain.tld
    DocumentRoot "${SRVROOT}/htdocs/jellyfin"
    ErrorLog "${SRVROOT}/logs/jellyfin_error.log"
    CustomLog "${SRVROOT}/logs/jellyfin_access.log" combined
    ProxyPreserveHost On
    ProxyPass "/.well-known/" "!"
   
    # Tell Jellyfin to forward that requests came from TLS connections
    RequestHeader set X-Forwarded-Proto "https"
    RequestHeader set X-Forwarded-Port "443"

    ProxyPass "/socket" "ws://localhost:8096/socket"
    ProxyPassReverse "/socket" "ws://localhost:8096/socket"
    ProxyPass "/" "http://localhost:8096/"
    ProxyPassReverse "/" "http://localhost:8096/"

    SSLEngine on
    SSLCertificateFile "${SRVROOT}/conf/ssl.crt/server.crt"
    SSLCertificateKeyFile "${SRVROOT}/conf/ssl.key/server.key"
    SSLCertificateChainFile "${SRVROOT}/conf/ssl.fullchain/fullchain.pem"
    Protocols h2 http/1.1

    ### Add headers ###
    RequestHeader set X-Forwarded-Proto 'https' env=HTTPS
    Header always set Strict-Transport-Security "max-age=15552000; preload"
    Header always set X-Content-Type-Options nosniff
    Header always set X-Robots-Tag none
    Header always set X-XSS-Protection "1; mode=block"
    Header always set X-Frame-Options "SAMEORIGIN"
    Header always set Referrer-Policy "same-origin"

    Header always set Content-Security-Policy "default-src 'self' dachs.blog; script-src 'self' 'unsafe-inline' dachs.blog www.gstatic.com/cv/js/; style-src 'self' 'unsafe-inline' dachs.blog cdn.jsdelivr.net/gh/CTalvio ctalvio.github.io fonts.googleapis.com/css2; connect-src 'self' dachs.blog; object-src 'none'; worker-src 'self' dachs.blog; frame-ancestors 'self' dachs.blog; base-uri 'self' dachs.blog"

    Header always set Feature-Policy "geolocation 'self'; midi 'self'; sync-xhr 'self'; microphone 'self'; camera 'self'; magnetometer 'self'; gyroscope 'self'; speaker 'self'; fullscreen 'self'; payment 'self'"

    RewriteEngine on
    RewriteRule ^/web/robots.txt https://domain.tld/robots.txt [L,R=301]
    RewriteRule ^/.well-known/security.txt https://domain.tld/.well-known/security.txt [L,R=301]
</VirtualHost>

[beankylla]

Hello,

I am experiencing a similar issue with a slightly different setup:

I am running jellyfin in docker behind nginx proxy manager.

[*]From the browser it always works flawlessly regardless of the origin

[*]with the android app:

• From my home i can always connect with ip + port no issues
  
• From my home connecting with Domain name does not work, EXCEPT when i connect to a  VPN, then the connection goes through and then i can disconnect from the vpn and it keeps working (i fail to understand the logic, maybe issue is only with the login?)
  
• From other places: it refuses to connect EXCEPT when i use the same VPN as at Home
  

Once successfully connected app works OK, even from a location that i could not connect from

I experience a different behavior with the flatpak app: connects OK from my computer whereas the androidTV box will refuse to connect.

Would be happy to provide any elements that would help

[TheDreadPirate]

Can you share screenshots of all the tabs for Nginx Proxy Manager? Censor the domain.

[esjaysee]

Maybe it's time to use Caddy? It just seems to work better for reverse proxies in Windows from my experience. Don't ask me why. But if you need a hand or a sample caddy file let me know.

[damsdams]

Hello, I finally found the problem. Jellyfin censors its own domain name, which means that when you host your own theme—on the same machine or possibly the same domain (to be confirmed)—the connection from the app is impossible, even though it works fine from any browser.

Also, it doesn't generate any errors in the logs or even on the system itself (Debian with Docker in my case). I went through all the logs and found nothing.