ZL154/JellyfinSecurity v2.1.0

v2.1.0 — Passkey primary login

on GitHub

🆕 Passkey primary login

Adds a "🔑 Sign in with passkey" button on the standard Jellyfin login page. Users with a registered passkey sign in with one tap — type username → click → authenticator prompt → signed in. No password, no 2FA challenge on top.

Uses the same one-shot bridge-token mechanism we built for OIDC in v2.0.

New endpoints (anonymous, rate-limited 20/5min per IP):

• POST /TwoFactorAuth/Passkey/LoginBegin → {options, nonce}
• POST /TwoFactorAuth/Passkey/LoginComplete → {username, token}

🐛 Fixes

• inject.js now returns Cache-Control: no-store. CDN / reverse-proxy caching no longer pins old script after plugin upgrades. Cloudflare users should add a Page Rule: jellyfin.example.com/TwoFactorAuth/* → Cache Level: Bypass for guaranteed immediate propagation.

⚠️ Note

WebAuthn requires a secure context (HTTPS or localhost). The passkey button is hidden when accessing Jellyfin over plain-HTTP LAN IPs — that's a browser constraint, not a plugin limit. Use the Cloudflare/public hostname for passkey login.

📦 Install

Update via the plugin catalog (manifest auto-refreshes), or download and drop in manually.

MD5: `09900B2B4B741CEFE6DCA77D13E09576`