Selfhosted

59850 readers

286 users here now

A place to share alternatives to popular online services that can be self-hosted without giving up privacy or locking you into a service you don't control.

Rules:

Be civil: we're here to support and learn from one another. Insults won't be tolerated. Flame wars are frowned upon.
No spam.
Posts here are to be centered around self-hosting. Please ensure it is clear in your post how it relates to self-hosting.
Don't duplicate the full text of your blog or git here. Just post the link for folks to click.
Submission headline should match the article title.
No trolling.

Resources:

selfh.st Newsletter and index of selfhosted software and apps
awesome-selfhosted software
awesome-sysadmin resources
Self-Hosted Podcast from Jupiter Broadcasting

Any issues on the community? Report it using the report flag.

Questions? DM the mods!

founded 3 years ago

MODERATORS

curbstickle@anarchist.nexus

curbstickle_lw@lemmy.world

What's the security situation when opening a jellyfin server up for casting? (feddit.nu)

submitted 6 months ago by lime@feddit.nu to c/selfhosted@lemmy.world

76 comments fedilink hide all child comments

when reading through the jellyfin with chromecast guide i realized that it would probably be less effort to just let the casting api be public, with the added bonus that i could then cast my library to any device that supports it. but that seems like it would paint a giant target on the server.

what's the recommended way of doing stuff like this? ideally i want to be able to go to someone's house and just play some of my media on their tv.

not that any of this is doable in the near future, since i'm behind cgnat and won't get my colocated bounce server up until spring.

you are viewing a single comment's thread
view the rest of the comments

[–] fightforlife@lemmy.world 2 points 6 months ago

An Idea I am also using for other things where I do not want to use a VPN:

Setup a reverse proxy (e.g. traefik)
Setup an oauth middleware for everything (forward Auth)
Create rules to exempt very specific request based on IP, headers, etc... from the middleware.

In the casting use case you have to find a request and check if there is any parameter that you can use to safely whitelist the request. Ofcourse someone could get behind this and fake the request to match the whitelist. But without knowing that there is even a whitelist no one will really try