ZL154/JellyfinSecurity v1.4.1

v1.4.1 — Fix Samsung Tizen sign-in behind reverse proxies

on GitHub

Bug-fix release

Critical regression fix for v1.4.0. Samsung Tizen (Smart TV) and Jellyfin-for-Tizen clients sitting behind a reverse proxy (Caddy, nginx, Cloudflare Tunnel, etc) couldn't sign in after the v1.4 upgrade — password entry returned "Invalid username or password" immediately.

Root cause

Tizen's /Users/AuthenticateByName request arrives at the server with no X-Emby-Device-Id header and an X-Emby-Authorization that the plugin's parser couldn't extract a deviceId from (some proxies reformat it). No deviceId meant every bypass path — paired-device, registered-device, trusted-device — silently skipped. The middleware then rewrote the auth response as a 2FA challenge, which the Tizen app can't render — it loops on "Invalid".

Fixes

• Enforcement middleware now reads SessionInfo.DeviceId from Jellyfin's auth response body as a fallback when request headers are stripped. That value is always present and authoritative.
• RegisteredDeviceIds lookup now uses the same UA-hash normaliser as PairedDevices so Tizen webview deviceIds survive app restarts.
• Removed dev-only diagnostic logging from the investigation.

Who needs this

• You're running Jellyfin behind Caddy / nginx / Cloudflare / Traefik / etc
• You have a Samsung Tizen TV / Smart TV with Jellyfin-for-Tizen installed
• You upgraded to v1.4.0 and the TV stopped signing in

No re-pair needed. Upgrade, try the TV sign-in, it just works.

Install

Manifest auto-update or https://raw.githubusercontent.com/ZL154/JellyfinSecurity/main/manifest.json.