Internal hardening pass on the auth pipeline plus a performance overhaul of the hot login path.
Hardening
- Cookie attribute handling behind reverse proxies, stricter forwarded-header handling, additional input bounds, tightened token binding.
- Trusted-browser cookie now carries the
Secureflag correctly when Jellyfin is behind a TLS-terminating proxy (Cloudflare, Caddy, nginx, Traefik). Enable via TrustForwardedFor + TrustedProxyCidrs in plugin settings.
Performance
- In-memory caches on the hot auth path: per-user data, audit log, parsed CIDRs, patched
/web/index. Disk I/O on every login is now near-zero. - Login latency improved by replacing an internal polling wait with immediate signaling.
- Audit log is now background-flushed and stored as compact JSON. Existing logs continue to read fine.
Packaging fixes (vs earlier rev)
- Zip ships only
runtimes/linux-x64/native libs; Windows / macOS native runtimes removed (Jellyfin's plugin loader was attempting to load them as managed assemblies). - Zip contents land at archive root (no wrapper folder) so the catalog extractor places DLLs directly under
<Name>_<Version>/. meta.jsonshipped with lowercase JSON keys + populatedtargetAbiso Jellyfin's catalog post-install rewrite preserves the assembly whitelist instead of zeroing it out.
No breaking changes. In-place upgrade.
MD5 29EF94596334EA4E67E9E34AEAD865B2